https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:14:45 +0000 https://vulnerability.circl.lu/vuln/cve-2026-26326 <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. Prior to version 2026.2.14, `skills.status` could disclose secrets to `operator.read` clients by returning raw resolved config values in `configChecks` for skill `requires.config` paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only `{ path, satisfied }`) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.</p> <p><strong>Affected:</strong> openclaw</p> <p>OpenClaw is a personal AI assistant. Prior to version 2026.2.14, `skills.status` could disclose secrets to `operator.read` clients by returning raw resolved config values in `configChecks` for skill `requires.config` paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only `{ path, satisfied }`) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.</p> https://vulnerability.circl.lu/vuln/cve-2026-26326 https://vulnerability.circl.lu/vuln/ghsa-8mh7-phf8-xgfm <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>`skills.status` could disclose secrets to `operator.read` clients by returning raw resolved config values in `configChecks` for skill `requires.config` paths.</p> <p>### Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.13` - Patched: `2026.2.14`</p> <p>### Details</p> <p>The gateway method `skills.status` returned a requirements report that included `configChecks[].value` (the resolved value for each `requires.config` entry). If a skill required a broad config subtree (for example `channels.discord`), the report could include secrets such as Discord bot tokens.</p> <p>`skills.status` is callable with `operator.read`, so read-scoped clients could obtain secrets without `operator.admin` / `config.*` access.</p> <p>### Fix</p> <p>- Stop including raw resolved config values in requirement checks (return only `{ path, satisfied }`). - Narrow the Discord skill requirement to the token key.</p> <p>Fix commit(s):</p> <p>- d3428053d95eefbe10ecf04f92218ffcba55ae5a - ebc68861a61067fc37f9298bded3eec9de0ba783</p> <p>### Mitigation</p> <p>Rotate any Discord tokens that may have been exposed to read-scoped clients.</p> <p>Thanks @simecek for reporting.</p> <p>---</p> <p>Fix commits d3428053d95eefbe10ecf04f92218ffcba55ae5a and ebc68861a61067fc37f9298bded3eec9de0ba783 confirmed on main and in v2026.2.14. Upgrade to `openclaw &gt;= 2026.2.14`.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>`skills.status` could disclose secrets to `operator.read` clients by returning raw resolved config values in `configChecks` for skill `requires.config` paths.</p> <p>### Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected: `&lt;= 2026.2.13` - Patched: `2026.2.14`</p> <p>### Details</p> <p>The gateway method `skills.status` returned a requirements report that included `configChecks[].value` (the resolved value for each `requires.config` entry). If a skill required a broad config subtree (for example `channels.discord`), the report could include secrets such as Discord bot tokens.</p> <p>`skills.status` is callable with `operator.read`, so read-scoped clients could obtain secrets without `operator.admin` / `config.*` access.</p> <p>### Fix</p> <p>- Stop including raw resolved config values in requirement checks (return only `{ path, satisfied }`). - Narrow the Discord skill requirement to the token key.</p> <p>Fix commit(s):</p> <p>- d3428053d95eefbe10ecf04f92218ffcba55ae5a - ebc68861a61067fc37f9298bded3eec9de0ba783</p> <p>### Mitigation</p> <p>Rotate any Discord tokens that may have been exposed to read-scoped clients.</p> <p>Thanks @simecek for reporting.</p> <p>---</p> <p>Fix commits d3428053d95eefbe10ecf04f92218ffcba55ae5a and ebc68861a61067fc37f9298bded3eec9de0ba783 confirmed on main and in v2026.2.14. Upgrade to `openclaw &gt;= 2026.2.14`.</p> https://vulnerability.circl.lu/vuln/ghsa-8mh7-phf8-xgfm