https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 17:05:46 +0000 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-53816 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>OpenClaw nodes send lifecycle events back to the gateway. In affected releases, a paired node could send an exec lifecycle event that was accepted without enough provenance tying it to an authorized `system.run` request.</p> <p>This issue affects the node event boundary. It does not allow an unauthenticated caller to reach the gateway; the attacker must already control a paired node connection.</p> <p>### Affected configurations</p> <p>This affects deployments with a paired node where that node can send crafted `node.event` messages to the gateway and the target agent/session can process exec lifecycle events.</p> <p>### Impact</p> <p>A malicious or compromised paired node could make the gateway treat attacker-supplied event data as an exec lifecycle result. In the vulnerable flow, that could steer the target session into an exec-event path that exposed capabilities the reduced node surface should not have provided.</p> <p>The issue is a missing provenance check for node-originated lifecycle events.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Pair nodes only from trusted environments, and remove/re-pair nodes that may have been compromised.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>OpenClaw nodes send lifecycle events back to the gateway. In affected releases, a paired node could send an exec lifecycle event that was accepted without enough provenance tying it to an authorized `system.run` request.</p> <p>This issue affects the node event boundary. It does not allow an unauthenticated caller to reach the gateway; the attacker must already control a paired node connection.</p> <p>### Affected configurations</p> <p>This affects deployments with a paired node where that node can send crafted `node.event` messages to the gateway and the target agent/session can process exec lifecycle events.</p> <p>### Impact</p> <p>A malicious or compromised paired node could make the gateway treat attacker-supplied event data as an exec lifecycle result. In the vulnerable flow, that could steer the target session into an exec-event path that exposed capabilities the reduced node surface should not have provided.</p> <p>The issue is a missing provenance check for node-originated lifecycle events.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Pair nodes only from trusted environments, and remove/re-pair nodes that may have been compromised.</p> https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-53816 https://cve.radiocsirt.org/vuln/euvd-2026-329568 EUVD-2026-329568 https://cve.radiocsirt.org/vuln/euvd-2026-329568 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53816 <p>OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node can send crafted node.event messages to the gateway, steering target sessions into exec-event paths that expose capabilities the reduced node surface should not provide.</p> <p>OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node can send crafted node.event messages to the gateway, steering target sessions into exec-event paths that expose capabilities the reduced node surface should not provide.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53816 https://cve.radiocsirt.org/vuln/ghsa-3c6j-hq33-3jv4 <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>OpenClaw nodes send lifecycle events back to the gateway. In affected releases, a paired node could send an exec lifecycle event that was accepted without enough provenance tying it to an authorized `system.run` request.</p> <p>This issue affects the node event boundary. It does not allow an unauthenticated caller to reach the gateway; the attacker must already control a paired node connection.</p> <p>### Affected configurations</p> <p>This affects deployments with a paired node where that node can send crafted `node.event` messages to the gateway and the target agent/session can process exec lifecycle events.</p> <p>### Impact</p> <p>A malicious or compromised paired node could make the gateway treat attacker-supplied event data as an exec lifecycle result. In the vulnerable flow, that could steer the target session into an exec-event path that exposed capabilities the reduced node surface should not have provided.</p> <p>The issue is a missing provenance check for node-originated lifecycle events.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Pair nodes only from trusted environments, and remove/re-pair nodes that may have been compromised.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>OpenClaw nodes send lifecycle events back to the gateway. In affected releases, a paired node could send an exec lifecycle event that was accepted without enough provenance tying it to an authorized `system.run` request.</p> <p>This issue affects the node event boundary. It does not allow an unauthenticated caller to reach the gateway; the attacker must already control a paired node connection.</p> <p>### Affected configurations</p> <p>This affects deployments with a paired node where that node can send crafted `node.event` messages to the gateway and the target agent/session can process exec lifecycle events.</p> <p>### Impact</p> <p>A malicious or compromised paired node could make the gateway treat attacker-supplied event data as an exec lifecycle result. In the vulnerable flow, that could steer the target session into an exec-event path that exposed capabilities the reduced node surface should not have provided.</p> <p>The issue is a missing provenance check for node-originated lifecycle events.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Pair nodes only from trusted environments, and remove/re-pair nodes that may have been compromised.</p> https://cve.radiocsirt.org/vuln/ghsa-3c6j-hq33-3jv4 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1738 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Sicherheitsmechanismen zu umgehen, erhöhte Berechtigungen zu erlangen, Informationen offenzulegen, Konfigurationen zu manipulieren, beliebige Befehle oder Code auszuführen sowie interne Systeme über SSRF anzugreifen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um Sicherheitsmechanismen zu umgehen, erhöhte Berechtigungen zu erlangen, Informationen offenzulegen, Konfigurationen zu manipulieren, beliebige Befehle oder Code auszuführen sowie interne Systeme über SSRF anzugreifen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1738