https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 05:27:09 +0000 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41347 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary HTTP operator endpoints lack browser-origin validation in trusted-proxy mode</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: This is a real trusted-proxy HTTP CSRF or browser-origin gap in released tags, but it is not critical because it depends on identity-bearing trusted-proxy browser deployments rather than the shared-secret HTTP operator model.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d` — 2026-03-31T19:49:26+09:00</p> <p>OpenClaw thanks @AntAISecurityLab for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary HTTP operator endpoints lack browser-origin validation in trusted-proxy mode</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: This is a real trusted-proxy HTTP CSRF or browser-origin gap in released tags, but it is not critical because it depends on identity-bearing trusted-proxy browser deployments rather than the shared-secret HTTP operator model.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d` — 2026-03-31T19:49:26+09:00</p> <p>OpenClaw thanks @AntAISecurityLab for reporting.</p> https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41347 https://cve.radiocsirt.org/vuln/euvd-2026-292991 EUVD-2026-292991 https://cve.radiocsirt.org/vuln/euvd-2026-292991 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41347 <p>OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a browser in trusted-proxy deployments to perform unauthorized actions on HTTP operator endpoints.</p> <p>OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a browser in trusted-proxy deployments to perform unauthorized actions on HTTP operator endpoints.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41347 https://cve.radiocsirt.org/vuln/ghsa-mhr7-2xmv-4c4q <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary HTTP operator endpoints lack browser-origin validation in trusted-proxy mode</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: This is a real trusted-proxy HTTP CSRF or browser-origin gap in released tags, but it is not critical because it depends on identity-bearing trusted-proxy browser deployments rather than the shared-secret HTTP operator model.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d` — 2026-03-31T19:49:26+09:00</p> <p>OpenClaw thanks @AntAISecurityLab for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary HTTP operator endpoints lack browser-origin validation in trusted-proxy mode</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: This is a real trusted-proxy HTTP CSRF or browser-origin gap in released tags, but it is not critical because it depends on identity-bearing trusted-proxy browser deployments rather than the shared-secret HTTP operator model.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d` — 2026-03-31T19:49:26+09:00</p> <p>OpenClaw thanks @AntAISecurityLab for reporting.</p> https://cve.radiocsirt.org/vuln/ghsa-mhr7-2xmv-4c4q https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 <p>Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948