https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:51:36 +0000 https://cve.radiocsirt.org/vuln/cve-2026-35625 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by triggering local reconnection to silently escalate privileges and achieve remote code execution on the node.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit this by triggering local reconnection to silently escalate privileges and achieve remote code execution on the node.</p> https://cve.radiocsirt.org/vuln/cve-2026-35625 https://cve.radiocsirt.org/vuln/ghsa-fqw4-mph7-2vr8 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Gateway local shared-auth reconnect silently widens paired device scope from operator.read to operator.admin and reach node RCE</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` - Affected versions: `&lt;= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24`</p> <p>## Details</p> <p>Silent local shared-auth reconnects could previously auto-approve `scope-upgrade` requests and widen a paired device from `operator.read` to `operator.admin`. Commit `81ebc7e0344fd19c85778e883bad45e2da972229` blocks silent reconnect scope upgrades so widened scopes require an explicit pairing approval instead of an implicit local reconnect path.</p> <p>Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `81ebc7e0344fd19c85778e883bad45e2da972229`.</p> <p>## Fix Commit(s)</p> <p>- `81ebc7e0344fd19c85778e883bad45e2da972229`</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Gateway local shared-auth reconnect silently widens paired device scope from operator.read to operator.admin and reach node RCE</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` - Affected versions: `&lt;= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24`</p> <p>## Details</p> <p>Silent local shared-auth reconnects could previously auto-approve `scope-upgrade` requests and widen a paired device from `operator.read` to `operator.admin`. Commit `81ebc7e0344fd19c85778e883bad45e2da972229` blocks silent reconnect scope upgrades so widened scopes require an explicit pairing approval instead of an implicit local reconnect path.</p> <p>Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `81ebc7e0344fd19c85778e883bad45e2da972229`.</p> <p>## Fix Commit(s)</p> <p>- `81ebc7e0344fd19c85778e883bad45e2da972229`</p> https://cve.radiocsirt.org/vuln/ghsa-fqw4-mph7-2vr8