https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:07:16 +0000 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41378 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary Paired node escalates to gateway RCE via unrestricted node.event agent dispatch</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still lets paired role=node clients drive node.event agent.request into broader gateway-side tool access than node RPCs, but critical is overstated because a trusted paired node foothold is already required.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `a77928b1087e90f2a8903f8e5aca6dec9237ac62` — 2026-03-30T14:22:15+01:00</p> <p>OpenClaw thanks @AntAISecurityLab for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary Paired node escalates to gateway RCE via unrestricted node.event agent dispatch</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still lets paired role=node clients drive node.event agent.request into broader gateway-side tool access than node RPCs, but critical is overstated because a trusted paired node foothold is already required.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `a77928b1087e90f2a8903f8e5aca6dec9237ac62` — 2026-03-30T14:22:15+01:00</p> <p>OpenClaw thanks @AntAISecurityLab for reporting.</p> https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-41378 https://cve.radiocsirt.org/vuln/euvd-2026-307915 EUVD-2026-307915 https://cve.radiocsirt.org/vuln/euvd-2026-307915 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41378 <p>OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted agent.request dispatch to achieve remote code execution on the gateway.</p> <p>OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted agent.request dispatch to achieve remote code execution on the gateway.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41378 https://cve.radiocsirt.org/vuln/ghsa-gjm7-hw8f-73rq <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Paired node escalates to gateway RCE via unrestricted node.event agent dispatch</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still lets paired role=node clients drive node.event agent.request into broader gateway-side tool access than node RPCs, but critical is overstated because a trusted paired node foothold is already required.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `a77928b1087e90f2a8903f8e5aca6dec9237ac62` — 2026-03-30T14:22:15+01:00</p> <p>OpenClaw thanks @AntAISecurityLab for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Paired node escalates to gateway RCE via unrestricted node.event agent dispatch</p> <p>## Current Maintainer Triage - Status: narrow - Normalized severity: high - Assessment: v2026.3.28 still lets paired role=node clients drive node.event agent.request into broader gateway-side tool access than node RPCs, but critical is overstated because a trusted paired node foothold is already required.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `a77928b1087e90f2a8903f8e5aca6dec9237ac62` — 2026-03-30T14:22:15+01:00</p> <p>OpenClaw thanks @AntAISecurityLab for reporting.</p> https://cve.radiocsirt.org/vuln/ghsa-gjm7-hw8f-73rq https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948 <p>Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0948