https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:02:33 +0000 https://cve.radiocsirt.org/vuln/cve-2026-35669 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary bypass to gain elevated privileges and perform unauthorized administrative actions.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary bypass to gain elevated privileges and perform unauthorized administrative actions.</p> https://cve.radiocsirt.org/vuln/cve-2026-35669 https://cve.radiocsirt.org/vuln/ghsa-qm2m-28pf-hgjw <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Gateway Plugin HTTP auth: &#34;gateway&#34; Mints operator.admin Runtime Scope</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` - Affected versions: `&lt;= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24`</p> <p>## Details</p> <p>Gateway-authenticated plugin HTTP routes previously created a runtime scope set that included `operator.admin` regardless of caller-granted scopes. Commit `ec2dbcff9afd8a52e00de054b506c91726d9fbbe` keeps plugin HTTP runtime scopes least-privileged and preserves caller scope boundaries.</p> <p>Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `ec2dbcff9afd8a52e00de054b506c91726d9fbbe`.</p> <p>## Fix Commit(s)</p> <p>- `ec2dbcff9afd8a52e00de054b506c91726d9fbbe`</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Gateway Plugin HTTP auth: &#34;gateway&#34; Mints operator.admin Runtime Scope</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` - Affected versions: `&lt;= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24`</p> <p>## Details</p> <p>Gateway-authenticated plugin HTTP routes previously created a runtime scope set that included `operator.admin` regardless of caller-granted scopes. Commit `ec2dbcff9afd8a52e00de054b506c91726d9fbbe` keeps plugin HTTP runtime scopes least-privileged and preserves caller scope boundaries.</p> <p>Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `ec2dbcff9afd8a52e00de054b506c91726d9fbbe`.</p> <p>## Fix Commit(s)</p> <p>- `ec2dbcff9afd8a52e00de054b506c91726d9fbbe`</p> https://cve.radiocsirt.org/vuln/ghsa-qm2m-28pf-hgjw