Most recent entries from all

BREW-openclaw-cli-CVE-2026-41394 — OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

Affected: Homebrew: openclaw-cli

## Summary Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: v2026.3.28 still gives auth:"plugin" routes operator WRITE_SCOPE, but impact should stay limited to plugin routes that actually touch privileged runtime actions before plugin auth completes.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `2a1db0c0f1fa375004a95ba0ef030534790a6d47` — 2026-04-01T00:20:49+09:00

OpenClaw thanks @davidluzsilva for reporting.

EUVD-2026-308043

fkie_cve-2026-41394

OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators.

GHSA-mhgq-xpfq-6r66 — OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

Affected: npm: openclaw

## Summary Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

## Fix Commit(s) - `2a1db0c0f1fa375004a95ba0ef030534790a6d47` — 2026-04-01T00:20:49+09:00

OpenClaw thanks @davidluzsilva for reporting.

WID-SEC-W-2026-0948 — OpenClaw: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder andere, nicht näher spezifizierte Angriffe durchzuführen.