https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T22:36:48.064260+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41340 BREW-openclaw-cli-CVE-2026-41340 — OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts 2026-10-04T22:36:48.127086+00:00

Affected: Homebrew: openclaw-cli

## Summary Telegram legacy allowFrom migration fans default-account trust into all named accounts

## Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Shipped v2026.3.28 Telegram migration fans legacy default-account allowFrom trust into named accounts, which is an in-scope auth-boundary bug and low fits.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `d8c68c8d4265ea6fa5e8c5e056534c351bddef37` — 2026-03-31T12:51:38+01:00

## Release Process Note - The fix is already present in released version `2026.3.31`. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @smaeljaish771 for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-292922 EUVD-2026-292922 2026-10-04T22:36:48.127155+00:00 EUVD-2026-292922 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41340 fkie_cve-2026-41340 2026-10-04T22:36:48.127172+00:00

OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where Telegram legacy allowFrom migration incorrectly fans default-account trust into all named accounts. Attackers can exploit this trust propagation to bypass authentication controls and gain unauthorized access to named accounts.

 https://cve.radiocsirt.org/vuln/ghsa-q85g-cf2c-5gq6 GHSA-q85g-cf2c-5gq6 2026-10-04T22:36:48.127195+00:00

OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where Telegram legacy allowFrom migration incorrectly fans default-account trust into all named accounts. Attackers can exploit this trust propagation to bypass authentication controls and gain unauthorized access to named accounts.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-04T22:36:48.127211+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.