https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 11:05:32 +0000 https://vulnerability.circl.lu/vuln/cve-2026-41404 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can exploit this by declaring operator scopes on non-Control-UI clients, allowing self-declared scopes to persist on identity-bearing authentication paths and escalate privileges.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can exploit this by declaring operator scopes on non-Control-UI clients, allowing self-declared scopes to persist on identity-bearing authentication paths and escalate privileges.</p> https://vulnerability.circl.lu/vuln/cve-2026-41404 https://vulnerability.circl.lu/vuln/ghsa-g374-mggx-p6xc <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode</p> <p>## Current Maintainer Triage - Normalized severity: high - Assessment: v2026.3.28 still misses trusted-proxy scope clearing for non-Control-UI clients, so self-declared operator scopes can survive on a real identity-bearing auth path; the complete fix is unreleased.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `8b88b927cb0747ad24d95b07d35682bf85dc5b0e` — 2026-03-30T14:19:00+01:00</p> <p>OpenClaw thanks @north-echo for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode</p> <p>## Current Maintainer Triage - Normalized severity: high - Assessment: v2026.3.28 still misses trusted-proxy scope clearing for non-Control-UI clients, so self-declared operator scopes can survive on a real identity-bearing auth path; the complete fix is unreleased.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `&lt;=2026.3.28` - Patched versions: `&gt;= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`</p> <p>## Fix Commit(s) - `8b88b927cb0747ad24d95b07d35682bf85dc5b0e` — 2026-03-30T14:19:00+01:00</p> <p>OpenClaw thanks @north-echo for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-g374-mggx-p6xc