https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 10:24:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32027 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checks. Attackers can exploit this cross-context authorization flaw by using a sender approved via DM pairing to satisfy group sender allowlist checks without explicit presence in groupAllowFrom, bypassing group message access controls.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checks. Attackers can exploit this cross-context authorization flaw by using a sender approved via DM pairing to satisfy group sender allowlist checks without explicit presence in groupAllowFrom, bypassing group message access controls.</p> https://vulnerability.circl.lu/vuln/cve-2026-32027 https://vulnerability.circl.lu/vuln/ghsa-jv6r-27ww-4gw4 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary DM pairing-store identities were incorrectly eligible for group allowlist authorization checks, enabling cross-context authorization in group message paths.</p> <p>## Details In affected versions, group allowlist evaluation could inherit identities from the DM pairing store. A sender approved via DM pairing could satisfy group sender allowlist checks without being explicitly present in `groupAllowFrom`.</p> <p>This is an authorization-policy boundary issue between DM pairing and group allowlists.</p> <p>## Affected Packages / Versions - `openclaw` (npm): affected `&lt;= 2026.2.25` (latest published npm version at triage time) - `openclaw` (npm): patched `&gt;= 2026.2.26` (planned next release)</p> <p>## Fix Commit(s) - `openclaw/openclaw@8bdda7a651c21e98faccdbbd73081e79cffe8be0` - `openclaw/openclaw@051fdcc428129446e7c084260f837b7284279ce9`</p> <p>## Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`) so once npm release is published, maintainers can publish the advisory without additional metadata edits.</p> <p>## Maintainer Timeline Note Maintainers landed the initial fix before this report was filed; this report still provided useful independent confirmation of the issue class and exploit path.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary DM pairing-store identities were incorrectly eligible for group allowlist authorization checks, enabling cross-context authorization in group message paths.</p> <p>## Details In affected versions, group allowlist evaluation could inherit identities from the DM pairing store. A sender approved via DM pairing could satisfy group sender allowlist checks without being explicitly present in `groupAllowFrom`.</p> <p>This is an authorization-policy boundary issue between DM pairing and group allowlists.</p> <p>## Affected Packages / Versions - `openclaw` (npm): affected `&lt;= 2026.2.25` (latest published npm version at triage time) - `openclaw` (npm): patched `&gt;= 2026.2.26` (planned next release)</p> <p>## Fix Commit(s) - `openclaw/openclaw@8bdda7a651c21e98faccdbbd73081e79cffe8be0` - `openclaw/openclaw@051fdcc428129446e7c084260f837b7284279ce9`</p> <p>## Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`) so once npm release is published, maintainers can publish the advisory without additional metadata edits.</p> <p>## Maintainer Timeline Note Maintainers landed the initial fix before this report was filed; this report still provided useful independent confirmation of the issue class and exploit path.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-jv6r-27ww-4gw4