https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T10:25:38.989172+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41356 BREW-openclaw-cli-CVE-2026-41356 — OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation 2026-10-05T10:25:38.999242+00:00

Affected: Homebrew: openclaw-cli

## Summary Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation

## Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: v2026.3.28 rotates device tokens without disconnecting already-authenticated WebSocket sessions, which is a real but post-compromise revocation gap.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `91f7a6b0fd67b703897e6e307762d471ca09333d` — 2026-03-31T09:05:34+09:00

## Release Process Note - The fix is already present in released version `2026.3.31`. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @zsxsoft for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-292948 EUVD-2026-292948 2026-10-05T10:25:38.999309+00:00 EUVD-2026-292948 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41356 fkie_cve-2026-41356 2026-10-05T10:25:38.999325+00:00

OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.

 https://cve.radiocsirt.org/vuln/ghsa-rfqg-qgf8-xr9x GHSA-rfqg-qgf8-xr9x — OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation 2026-10-05T10:25:38.999347+00:00

Affected: npm: openclaw

## Summary Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation

## Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: v2026.3.28 rotates device tokens without disconnecting already-authenticated WebSocket sessions, which is a real but post-compromise revocation gap.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `91f7a6b0fd67b703897e6e307762d471ca09333d` — 2026-03-31T09:05:34+09:00

## Release Process Note - The fix is already present in released version `2026.3.31`. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @zsxsoft for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-05T10:25:38.999387+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.