https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T12:25:55.458243+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41374 BREW-openclaw-cli-CVE-2026-41374 — OpenClaw runs Discord audio preflight transcription before member authorization 2026-10-05T12:25:55.524692+00:00

Affected: Homebrew: openclaw-cli

## Summary Discord audio preflight transcription before member authorization

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still runs Discord audio preflight before member allowlist rejection, but this is the same pre-auth resource-consumption class and not the high-severity auth-bypass framing in the draft.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `ee52f64226a03efadfdf1e3b759e13424a3d4e41` — 2026-03-30T14:38:22+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

 https://cve.radiocsirt.org/vuln/euvd-2026-307806 EUVD-2026-307806 2026-10-05T12:25:55.524761+00:00 EUVD-2026-307806 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41374 fkie_cve-2026-41374 2026-10-05T12:25:55.524779+00:00

OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume resources. Remote attackers can trigger audio preflight processing without member allowlist validation to cause resource exhaustion.

 https://cve.radiocsirt.org/vuln/ghsa-hhff-fj5f-qg48 GHSA-hhff-fj5f-qg48 — OpenClaw runs Discord audio preflight transcription before member authorization 2026-10-05T12:25:55.524803+00:00

Affected: npm: openclaw

## Summary Discord audio preflight transcription before member authorization

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still runs Discord audio preflight before member allowlist rejection, but this is the same pre-auth resource-consumption class and not the high-severity auth-bypass framing in the draft.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `ee52f64226a03efadfdf1e3b759e13424a3d4e41` — 2026-03-30T14:38:22+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen 2026-10-05T12:25:55.524832+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.