https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 04:43:51 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32035 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true. Non-owner voice participants can exploit this omission to access owner-only tools including gateway and cron functionality in mixed-trust channels.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true. Non-owner voice participants can exploit this omission to access owner-only tools including gateway and cron functionality in mixed-trust channels.</p> https://vulnerability.circl.lu/vuln/cve-2026-32035 https://vulnerability.circl.lu/vuln/ghsa-wpg9-4g4v-f9rc <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary In `openclaw@2026.3.1`, the Discord voice transcript path called `agentCommand(...)` without `senderIsOwner`, and `agentCommand` defaults missing `senderIsOwner` to `true`.</p> <p>This could allow a non-owner voice participant in the same channel to reach owner-only tool surfaces (`gateway`, `cron`) during voice transcript turns.</p> <p>### Security model note OpenClaw’s documented trust model is a **personal assistant** model (one trusted operator), not an adversarial multi-user boundary.</p> <p>- OpenClaw does **not** treat one shared gateway/chat surface as a hardened per-user auth boundary. - Mixed-trust deployments (mutually untrusted users sharing one gateway/channel) are outside recommended deployment boundaries.</p> <p>This report is treated as a valid hardening/authorization bug because owner-only tool policy should still be applied consistently across chat-driven turns, including Discord voice transcript ingress.</p> <p>### Details Relevant path: 1. Voice transcript run omitted `senderIsOwner` in Discord voice manager. 2. Missing `senderIsOwner` defaulted to `true` in `agentCommand`. 3. Owner-only tool policy is keyed on `senderIsOwner`. 4. `gateway` and `cron` are owner-only tools.</p> <p>### Impact - Affects deployments where Discord voice is enabled and the bot is present in channels with non-owner participants. - No gateway-auth boundary bypass was required. - Practical risk depends strongly on whether the deployment is single-trust (recommended) or mixed-trust (not recommended).</p> <p>###…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary In `openclaw@2026.3.1`, the Discord voice transcript path called `agentCommand(...)` without `senderIsOwner`, and `agentCommand` defaults missing `senderIsOwner` to `true`.</p> <p>This could allow a non-owner voice participant in the same channel to reach owner-only tool surfaces (`gateway`, `cron`) during voice transcript turns.</p> <p>### Security model note OpenClaw’s documented trust model is a **personal assistant** model (one trusted operator), not an adversarial multi-user boundary.</p> <p>- OpenClaw does **not** treat one shared gateway/chat surface as a hardened per-user auth boundary. - Mixed-trust deployments (mutually untrusted users sharing one gateway/channel) are outside recommended deployment boundaries.</p> <p>This report is treated as a valid hardening/authorization bug because owner-only tool policy should still be applied consistently across chat-driven turns, including Discord voice transcript ingress.</p> <p>### Details Relevant path: 1. Voice transcript run omitted `senderIsOwner` in Discord voice manager. 2. Missing `senderIsOwner` defaulted to `true` in `agentCommand`. 3. Owner-only tool policy is keyed on `senderIsOwner`. 4. `gateway` and `cron` are owner-only tools.</p> <p>### Impact - Affects deployments where Discord voice is enabled and the bot is present in channels with non-owner participants. - No gateway-auth boundary bypass was required. - Practical risk depends strongly on whether the deployment is single-trust (recommended) or mixed-trust (not recommended).</p> <p>###…</p> https://vulnerability.circl.lu/vuln/ghsa-wpg9-4g4v-f9rc