https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T20:41:12.070088+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-43535 BREW-openclaw-cli-CVE-2026-43535 — OpenClaw: Collect-mode queue batches could reuse the last sender authorization context 2026-10-04T20:41:12.074092+00:00

Affected: Homebrew: openclaw-cli

## Summary

Collect-mode queue batches could reuse the last sender authorization context.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.14` - Patched versions: `>= 2026.4.14`

## Impact

Collect-mode queued messages from different senders could be drained as one batch using the final sender's authorization context, allowing earlier messages to inherit a more privileged context.

## Technical Details

The fix splits collect-mode batches by sender authorization context before dispatch, preserving each message's own trust state.

## Fix

The issue was fixed in #66024. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `43d4be902755c970b3d15608679761877718da69` - PR: #66024

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-308521 EUVD-2026-308521 2026-10-04T20:41:12.074156+00:00 EUVD-2026-308521 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43535 fkie_cve-2026-43535 2026-10-04T20:41:12.074173+00:00

OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final sender's authorization context. Attackers can exploit this by sending multiple queued messages to drain batches using a more privileged sender's context, causing earlier messages to execute with elevated permissions.

 https://cve.radiocsirt.org/vuln/ghsa-jwrq-8g5x-5fhm GHSA-jwrq-8g5x-5fhm — OpenClaw: Collect-mode queue batches could reuse the last sender authorization context 2026-10-04T20:41:12.074196+00:00

Affected: npm: openclaw

## Summary

Collect-mode queue batches could reuse the last sender authorization context.

## Affected Packages / Versions

- Package: `openclaw` - Ecosystem: npm - Affected versions: `< 2026.4.14` - Patched versions: `>= 2026.4.14`

## Impact

Collect-mode queued messages from different senders could be drained as one batch using the final sender's authorization context, allowing earlier messages to inherit a more privileged context.

## Technical Details

The fix splits collect-mode batches by sender authorization context before dispatch, preserving each message's own trust state.

## Fix

The issue was fixed in #66024. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `43d4be902755c970b3d15608679761877718da69` - PR: #66024

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1161 WID-SEC-W-2026-1161 — OpenClaw: Mehrere Schwachstellen 2026-10-04T20:41:12.074231+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.