https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T08:52:33.001958+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-41300 CVE-2026-41300 — OpenClaw < 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboarding 2026-09-28T08:52:33.004613+00:00

Affected: OpenClaw

OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote onboarding flows. Attackers can route gateway credentials to malicious endpoints by having their discovered URL survive the trust decline process into manual prompts requiring operator acceptance.

 https://vulnerability.circl.lu/vuln/ghsa-9f4w-67g7-mqwv GHSA-9f4w-67g7-mqwv — OpenClaw: Endpoint persists after trust decline, leaking gateway credentials 2026-09-28T08:52:33.004718+00:00

Affected: npm: openclaw

## Summary Remote onboarding preserves attacker-discovered endpoint after trust decline, routing gateway credentials to it

## Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real shipped onboarding trust-decline bug because the declined discovered URL survived into the manual prompt, but operator acceptance of that prefill is still required, so medium.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `2a75416634837c21ed05b8c3ed906eb7a7807060` — 2026-03-30T20:03:06+01:00

## Release Process Note - The fix is already present in released version `2026.3.31`. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @zsxsoft for reporting.