https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 10:18:42 +0000 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-27488 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Affected Packages / Versions</p> <p>- `openclaw` npm package versions `&lt;= 2026.2.17`.</p> <p>## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.</p> <p>## Fix Commit(s) - `99db4d13e` - `35851cdaf`</p> <p>Thanks @Adam55A-code for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Affected Packages / Versions</p> <p>- `openclaw` npm package versions `&lt;= 2026.2.17`.</p> <p>## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.</p> <p>## Fix Commit(s) - `99db4d13e` - `35851cdaf`</p> <p>Thanks @Adam55A-code for reporting.</p> https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-27488 https://cve.radiocsirt.org/vuln/cnvd-2026-13388 cnvd-2026-13388 https://cve.radiocsirt.org/vuln/cnvd-2026-13388 https://cve.radiocsirt.org/vuln/euvd-2026-270427 EUVD-2026-270427 https://cve.radiocsirt.org/vuln/euvd-2026-270427 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27488 <p>OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.</p> <p>OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.ts uses fetch() directly, so webhook targets can reach private/metadata/internal endpoints without SSRF policy checks. This issue was fixed in version 2026.2.19.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27488 https://cve.radiocsirt.org/vuln/ghsa-w45g-5746-x9fp <p><strong>Affected:</strong> npm: openclaw</p> <p>## Affected Packages / Versions</p> <p>- `openclaw` npm package versions `&lt;= 2026.2.17`.</p> <p>## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.</p> <p>## Fix Commit(s) - `99db4d13e` - `35851cdaf`</p> <p>Thanks @Adam55A-code for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Affected Packages / Versions</p> <p>- `openclaw` npm package versions `&lt;= 2026.2.17`.</p> <p>## Vulnerability Cron webhook delivery in `src/gateway/server-cron.ts` used `fetch()` directly, so webhook targets could reach private/metadata/internal endpoints without SSRF policy checks.</p> <p>## Fix Commit(s) - `99db4d13e` - `35851cdaf`</p> <p>Thanks @Adam55A-code for reporting.</p> https://cve.radiocsirt.org/vuln/ghsa-w45g-5746-x9fp