https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:47:13 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32025 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user into opening a malicious webpage and perform password brute-force attacks against the gateway to establish an authenticated operator session and invoke control-plane methods.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user into opening a malicious webpage and perform password brute-force attacks against the gateway to establish an authenticated operator session and invoke control-plane methods.</p> https://vulnerability.circl.lu/vuln/cve-2026-32025 https://vulnerability.circl.lu/vuln/ghsa-jmmg-jqc7-5qf4 <p><strong>Affected:</strong> npm: openclaw</p> <p>This issue is a browser-origin WebSocket auth chain on local loopback deployments using password auth. It is serious, but conditional: an attacker must get the user to open a malicious page and then successfully guess the gateway password.</p> <p>## Context and Preconditions</p> <p>OpenClaw’s web/gateway surface is designed for local use and trusted-operator workflows. In affected versions, a browser-origin client could combine three behaviors:</p> <p>- Origin checks not enforced for some non-Control-UI WebSocket client IDs. - Loopback auth attempts exempt from password-failure throttling. - Silent local pairing path available to browser-origin non-Control-UI clients.</p> <p>Successful exploitation requires all of the following:</p> <p>- Gateway reachable on loopback (default). - Password auth mode in use. - Victim opens attacker-controlled web content. - Password is guessable within feasible brute-force/dictionary attempts.</p> <p>## Practical Impact</p> <p>If the password is guessed, an attacker can establish an authenticated operator WebSocket session and invoke control-plane methods available to that role. This is not an unauthenticated internet-exposed RCE class issue by itself; it is a local browser-origin auth-hardening gap with meaningful impact under the conditions above.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;=2026.2.24` (latest published npm version as of February 26, 2026) - Patched versions : `&gt;=2026.2.25`</p> <p>## Fix Commit(s)</p> <p>- `c736f11a16d6bc27ea62a0fe40fffa…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>This issue is a browser-origin WebSocket auth chain on local loopback deployments using password auth. It is serious, but conditional: an attacker must get the user to open a malicious page and then successfully guess the gateway password.</p> <p>## Context and Preconditions</p> <p>OpenClaw’s web/gateway surface is designed for local use and trusted-operator workflows. In affected versions, a browser-origin client could combine three behaviors:</p> <p>- Origin checks not enforced for some non-Control-UI WebSocket client IDs. - Loopback auth attempts exempt from password-failure throttling. - Silent local pairing path available to browser-origin non-Control-UI clients.</p> <p>Successful exploitation requires all of the following:</p> <p>- Gateway reachable on loopback (default). - Password auth mode in use. - Victim opens attacker-controlled web content. - Password is guessable within feasible brute-force/dictionary attempts.</p> <p>## Practical Impact</p> <p>If the password is guessed, an attacker can establish an authenticated operator WebSocket session and invoke control-plane methods available to that role. This is not an unauthenticated internet-exposed RCE class issue by itself; it is a local browser-origin auth-hardening gap with meaningful impact under the conditions above.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;=2026.2.24` (latest published npm version as of February 26, 2026) - Patched versions : `&gt;=2026.2.25`</p> <p>## Fix Commit(s)</p> <p>- `c736f11a16d6bc27ea62a0fe40fffa…</p> https://vulnerability.circl.lu/vuln/ghsa-jmmg-jqc7-5qf4