https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 16:00:34 +0000 https://cve.radiocsirt.org/vuln/cve-2026-41394 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators.</p> https://cve.radiocsirt.org/vuln/cve-2026-41394 https://cve.radiocsirt.org/vuln/ghsa-mhgq-xpfq-6r66 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Unauthenticated plugin-auth HTTP routes receive operator runtime scopes</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still gives auth:&#34;plugin&#34; routes operator WRITE_SCOPE, but impact should stay limited to plugin routes that actually touch privileged runtime actions before plugin auth completes.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `2a1db0c0f1fa375004a95ba0ef030534790a6d47` — 2026-04-01T00:20:49+09:00</p> <p>OpenClaw thanks @davidluzsilva for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Unauthenticated plugin-auth HTTP routes receive operator runtime scopes</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still gives auth:&#34;plugin&#34; routes operator WRITE_SCOPE, but impact should stay limited to plugin routes that actually touch privileged runtime actions before plugin auth completes.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `2a1db0c0f1fa375004a95ba0ef030534790a6d47` — 2026-04-01T00:20:49+09:00</p> <p>OpenClaw thanks @davidluzsilva for reporting.</p> https://cve.radiocsirt.org/vuln/ghsa-mhgq-xpfq-6r66