https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 19:15:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-41344 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verboseLevel session overrides. Attackers can exploit the /verbose parameter to bypass access controls and expose sensitive reasoning or tool output intended to be restricted to administrators.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verboseLevel session overrides. Attackers can exploit the /verbose parameter to bypass access controls and expose sensitive reasoning or tool output intended to be restricted to administrators.</p> https://vulnerability.circl.lu/vuln/cve-2026-41344 https://vulnerability.circl.lu/vuln/ghsa-5h2w-qmfp-ggp6 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>The `chat.send` path let authorized write-scoped callers persist `/verbose` session overrides even though the same stored session mutation is admin-only through `sessions.patch`.</p> <p>## Impact</p> <p>A write-scoped gateway caller could persist verbose output for later runs and expose more reasoning or tool output than the operator intended.</p> <p>## Affected Component</p> <p>`src/auto-reply/reply/directive-handling.impl.ts, src/gateway/sessions-patch.ts`</p> <p>## Fixed Versions</p> <p>- Affected: `&lt;= 2026.3.24` - Patched: `&gt;= 2026.3.28` - Latest stable `2026.3.28` contains the fix.</p> <p>## Fix</p> <p>Fixed by commit `c603123528` (`fix(gateway): require admin for persisted verbose defaults`).</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>The `chat.send` path let authorized write-scoped callers persist `/verbose` session overrides even though the same stored session mutation is admin-only through `sessions.patch`.</p> <p>## Impact</p> <p>A write-scoped gateway caller could persist verbose output for later runs and expose more reasoning or tool output than the operator intended.</p> <p>## Affected Component</p> <p>`src/auto-reply/reply/directive-handling.impl.ts, src/gateway/sessions-patch.ts`</p> <p>## Fixed Versions</p> <p>- Affected: `&lt;= 2026.3.24` - Patched: `&gt;= 2026.3.28` - Latest stable `2026.3.28` contains the fix.</p> <p>## Fix</p> <p>Fixed by commit `c603123528` (`fix(gateway): require admin for persisted verbose defaults`).</p> https://vulnerability.circl.lu/vuln/ghsa-5h2w-qmfp-ggp6