https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 01:33:05 +0000 https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-27484 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Overview</p> <p>Discord moderation action handling (`timeout`, `kick`, `ban`) used sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context.</p> <p>## Impact</p> <p>In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user could request moderation actions by spoofing sender identity fields.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Latest published affected version (as of 2026-02-19): `2026.2.17` - Affected range: `&lt;=2026.2.17` - Fixed in planned next release: `2026.2.18`</p> <p>## Fix</p> <p>- Moderation authorization now uses trusted sender context (`requesterSenderId`) instead of untrusted action params. - Added permission checks for required guild capabilities per action.</p> <p>## Fix Commit(s)</p> <p>- `775816035ecc6bb243843f8000c9a58ff609e32d`</p> <p>Thanks @aether-ai-agent for reporting.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Overview</p> <p>Discord moderation action handling (`timeout`, `kick`, `ban`) used sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context.</p> <p>## Impact</p> <p>In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user could request moderation actions by spoofing sender identity fields.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Latest published affected version (as of 2026-02-19): `2026.2.17` - Affected range: `&lt;=2026.2.17` - Fixed in planned next release: `2026.2.18`</p> <p>## Fix</p> <p>- Moderation authorization now uses trusted sender context (`requesterSenderId`) instead of untrusted action params. - Added permission checks for required guild capabilities per action.</p> <p>## Fix Commit(s)</p> <p>- `775816035ecc6bb243843f8000c9a58ff609e32d`</p> <p>Thanks @aether-ai-agent for reporting.</p> https://cve.radiocsirt.org/vuln/brew-openclaw-cli-cve-2026-27484 https://cve.radiocsirt.org/vuln/cve-2026-27484 <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user can request moderation actions by spoofing sender identity fields. This issue has been fixed in version 2026.2.18.</p> <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin user can request moderation actions by spoofing sender identity fields. This issue has been fixed in version 2026.2.18.</p> https://cve.radiocsirt.org/vuln/cve-2026-27484