https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 17:32:45 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32067 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.</p> https://vulnerability.circl.lu/vuln/cve-2026-32067 https://vulnerability.circl.lu/vuln/ghsa-vjp8-wprm-2jw9 <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary OpenClaw had account-scope gaps in pairing-store access for DM pairing policy, which could let a pairing approval from one account authorize the same sender on another account in multi-account setups.</p> <p>### Impact This is an authorization-boundary weakness in multi-account channel deployments. A sender approved in one account could be accepted in another account before explicit approval there.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version affected: `2026.2.25` - Vulnerable range: `&lt;= 2026.2.25` - Patched version (planned next release): `&gt;= 2026.2.26`</p> <p>### Fix OpenClaw now enforces account-scoped pairing reads/writes consistently across core and extension message channels, with stricter runtime/SDK helpers and shared policy wiring to prevent cross-account pairing bleed.</p> <p>### Fix Commit(s) - `a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf` - `bce643a0bd145d3e9cb55400af33bd1b85baeb02`</p> <p>### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish of that version, this advisory is ready to publish without further content edits.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary OpenClaw had account-scope gaps in pairing-store access for DM pairing policy, which could let a pairing approval from one account authorize the same sender on another account in multi-account setups.</p> <p>### Impact This is an authorization-boundary weakness in multi-account channel deployments. A sender approved in one account could be accepted in another account before explicit approval there.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version affected: `2026.2.25` - Vulnerable range: `&lt;= 2026.2.25` - Patched version (planned next release): `&gt;= 2026.2.26`</p> <p>### Fix OpenClaw now enforces account-scoped pairing reads/writes consistently across core and extension message channels, with stricter runtime/SDK helpers and shared policy wiring to prevent cross-account pairing bleed.</p> <p>### Fix Commit(s) - `a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf` - `bce643a0bd145d3e9cb55400af33bd1b85baeb02`</p> <p>### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish of that version, this advisory is ready to publish without further content edits.</p> <p>OpenClaw thanks @tdjackey for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-vjp8-wprm-2jw9