https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T09:19:38.431099+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41347 BREW-openclaw-cli-CVE-2026-41347 — OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode 2026-10-05T09:19:38.501768+00:00

Affected: Homebrew: openclaw-cli

## Summary HTTP operator endpoints lack browser-origin validation in trusted-proxy mode

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: This is a real trusted-proxy HTTP CSRF or browser-origin gap in released tags, but it is not critical because it depends on identity-bearing trusted-proxy browser deployments rather than the shared-secret HTTP operator model.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d` — 2026-03-31T19:49:26+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-292991 EUVD-2026-292991 2026-10-05T09:19:38.501834+00:00 EUVD-2026-292991 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41347 fkie_cve-2026-41347 2026-10-05T09:19:38.501850+00:00

OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a browser in trusted-proxy deployments to perform unauthorized actions on HTTP operator endpoints.

 https://cve.radiocsirt.org/vuln/ghsa-mhr7-2xmv-4c4q GHSA-mhr7-2xmv-4c4q — OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode 2026-10-05T09:19:38.501875+00:00

Affected: npm: openclaw

## Summary HTTP operator endpoints lack browser-origin validation in trusted-proxy mode

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: This is a real trusted-proxy HTTP CSRF or browser-origin gap in released tags, but it is not critical because it depends on identity-bearing trusted-proxy browser deployments rather than the shared-secret HTTP operator model.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d` — 2026-03-31T19:49:26+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-05T09:19:38.501905+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.