Most recent entries from all

BREW-openclaw-cli-CVE-2026-35624 — OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens

Affected: Homebrew: openclaw-cli

## Summary Nextcloud Talk room authorization matched on collidable room names instead of the stable room token, allowing policy confusion across similarly named rooms.

## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: < 2026.3.22 - Fixed: >= 2026.3.22 - Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) - Latest published npm version checked: `2026.3.23-2`

## Fix Commit(s) - `a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66`

## Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

## Code-Level Confirmation - extensions/nextcloud-talk/src/inbound.ts now resolves allowlist policy from roomToken-backed room identity. - extensions/nextcloud-talk/src/policy.ts now keys room authorization on stable room tokens instead of display names.

OpenClaw thanks @zpbrent for reporting.

cnvd-2026-21186

EUVD-2026-329502

fkie_cve-2026-35624

OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms.

GHSA-xhq5-45pm-2gjr — OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens

Affected: npm: openclaw

## Summary Nextcloud Talk room authorization matched on collidable room names instead of the stable room token, allowing policy confusion across similarly named rooms.

## Fix Commit(s) - `a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66`

## Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.

OpenClaw thanks @zpbrent for reporting.

WID-SEC-W-2026-0856 — OpenClaw: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen – sogar Administratorrechte – zu erlangen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.