https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T01:50:08.787947+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41345 BREW-openclaw-cli-CVE-2026-41345 — OpenClaw: Media download follows cross-origin redirects with Authorization headers intact 2026-10-05T01:50:08.795895+00:00

Affected: Homebrew: openclaw-cli

## Summary Media download follows cross-origin redirects with Authorization headers intact

## Current Maintainer Triage - Status: open - Normalized severity: medium - Assessment: Shipped v2026.3.28 media downloads forwarded Authorization across cross-origin redirects, a real in-scope credential-leak class that fits medium.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `e704323ff388ed21f6963f9b8e0b1b8dfaaabc5f` — 2026-03-31T19:57:42+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-292881 EUVD-2026-292881 2026-10-05T01:50:08.795965+00:00 EUVD-2026-292881 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41345 fkie_cve-2026-41345 2026-10-05T01:50:08.795983+00:00

OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects. Attackers can exploit this by crafting malicious cross-origin redirect chains to intercept sensitive authorization credentials intended for legitimate requests.

 https://cve.radiocsirt.org/vuln/ghsa-49m4-chpx-gw3r GHSA-49m4-chpx-gw3r 2026-10-05T01:50:08.796008+00:00

OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects. Attackers can exploit this by crafting malicious cross-origin redirect chains to intercept sensitive authorization credentials intended for legitimate requests.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-05T01:50:08.796024+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.