https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:38:06 +0000 https://cve.radiocsirt.org/vuln/cve-2026-32057 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.</p> https://cve.radiocsirt.org/vuln/cve-2026-32057 https://cve.radiocsirt.org/vuln/ghsa-vvgp-4c28-m3jm <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary A trusted-proxy Control UI pairing bypass accepted `client.id=control-ui` without device identity checks. The bypass did not require `operator` role, so an authenticated `node` role session could connect unpaired and reach node event methods.</p> <p>## Impact With trusted-proxy authentication enabled, a `node` role websocket client could skip pairing by using `client.id=control-ui`. That created an authorization boundary bypass from a node-scoped connection into node event execution flows.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected range: `&lt;= 2026.2.24` - Latest published vulnerable version: `2026.2.24` - Patched in next release: `2026.2.25` (pre-set below so this advisory is ready to publish after npm release)</p> <p>## Fix The trusted-proxy Control UI bypass now additionally requires `role === &#34;operator&#34;`.</p> <p>### Fix Commit(s) - `ec45c317f5d0631a3d333b236da58c4749ede2a3`</p> <p>## Release Process Note `patched_versions` is intentionally pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.2.25` is published, the remaining GHSA action is to publish this advisory.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary A trusted-proxy Control UI pairing bypass accepted `client.id=control-ui` without device identity checks. The bypass did not require `operator` role, so an authenticated `node` role session could connect unpaired and reach node event methods.</p> <p>## Impact With trusted-proxy authentication enabled, a `node` role websocket client could skip pairing by using `client.id=control-ui`. That created an authorization boundary bypass from a node-scoped connection into node event execution flows.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected range: `&lt;= 2026.2.24` - Latest published vulnerable version: `2026.2.24` - Patched in next release: `2026.2.25` (pre-set below so this advisory is ready to publish after npm release)</p> <p>## Fix The trusted-proxy Control UI bypass now additionally requires `role === &#34;operator&#34;`.</p> <p>### Fix Commit(s) - `ec45c317f5d0631a3d333b236da58c4749ede2a3`</p> <p>## Release Process Note `patched_versions` is intentionally pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.2.25` is published, the remaining GHSA action is to publish this advisory.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> https://cve.radiocsirt.org/vuln/ghsa-vvgp-4c28-m3jm