https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 18:57:24 +0000 https://cve.radiocsirt.org/vuln/cve-2026-35662 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond their authorized scope. Attackers can exploit this by using the send action to communicate with child sessions without proper scope validation, bypassing intended access control restrictions.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond their authorized scope. Attackers can exploit this by using the send action to communicate with child sessions without proper scope validation, bypassing intended access control restrictions.</p> https://cve.radiocsirt.org/vuln/cve-2026-35662 https://cve.radiocsirt.org/vuln/ghsa-x2cm-hg9c-mf5w <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Leaf subagents could still use the send action to message controlled child sessions even when their controlScope was narrower than children.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: &lt; 2026.3.22 - Fixed: &gt;= 2026.3.22 - Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) - Latest published npm version checked: `2026.3.23-2`</p> <p>## Fix Commit(s) - `7679eb375294941b02214c234aff3948796969d0`</p> <p>## Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.</p> <p>## Code-Level Confirmation - src/auto-reply/reply/commands-subagents/action-send.ts now threads controller context through the send path. - src/agents/subagent-control.ts now blocks send attempts unless the requester owns the target and has controlScope=&#34;children&#34;.</p> <p>OpenClaw thanks @space08 for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Leaf subagents could still use the send action to message controlled child sessions even when their controlScope was narrower than children.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: &lt; 2026.3.22 - Fixed: &gt;= 2026.3.22 - Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) - Latest published npm version checked: `2026.3.23-2`</p> <p>## Fix Commit(s) - `7679eb375294941b02214c234aff3948796969d0`</p> <p>## Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.</p> <p>## Code-Level Confirmation - src/auto-reply/reply/commands-subagents/action-send.ts now threads controller context through the send path. - src/agents/subagent-control.ts now blocks send attempts unless the requester owns the target and has controlScope=&#34;children&#34;.</p> <p>OpenClaw thanks @space08 for reporting.</p> https://cve.radiocsirt.org/vuln/ghsa-x2cm-hg9c-mf5w