https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:48:24 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32045 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements. Attackers on trusted networks can exploit this misconfiguration to access HTTP gateway routes without proper authentication credentials.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements. Attackers on trusted networks can exploit this misconfiguration to access HTTP gateway routes without proper authentication credentials.</p> https://vulnerability.circl.lu/vuln/cve-2026-32045 https://vulnerability.circl.lu/vuln/ghsa-hff7-ccv5-52f8 <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary When tokenless Tailscale auth is enabled, OpenClaw should only allow forwarded-header auth for Control UI websocket authentication on trusted hosts. In affected versions, that tokenless path could also be used by HTTP gateway auth call sites, which could bypass token/password requirements for HTTP routes in trusted-network deployments.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Affected range: `&lt;= 2026.2.19-2` (latest published npm version as of February 21, 2026) - Patched in: planned `2026.2.21` release</p> <p>### Impact Deployments relying on token/password for HTTP gateway routes could be downgraded to tokenless behavior when Tailscale header auth is enabled. This weakens expected HTTP route authentication boundaries even in trusted-host network setups.</p> <p>Per SECURITY.md, this does not affect the recommended setup: keep the Gateway loopback-only (or otherwise within a trusted host/network boundary), use Tailscale serve/funnel for remote access, and keep tokenless Tailscale auth scoped to Control UI websocket login.</p> <p>### Fix - Added an explicit auth-surface gate (`allowTailscaleHeaderAuth`, default `false`) in gateway auth. - Enabled tokenless Tailscale header auth only for Control UI websocket authentication. - Kept HTTP gateway auth call sites on token/password auth paths. - Added regression coverage for HTTP-vs-websocket behavior and Tailscale header handling.</p> <p>### Fix Commit(s) - `356d61aacfa5b0f1d5830716ec59d70682a3e7b8`</p> <p>### Release Process…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary When tokenless Tailscale auth is enabled, OpenClaw should only allow forwarded-header auth for Control UI websocket authentication on trusted hosts. In affected versions, that tokenless path could also be used by HTTP gateway auth call sites, which could bypass token/password requirements for HTTP routes in trusted-network deployments.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Affected range: `&lt;= 2026.2.19-2` (latest published npm version as of February 21, 2026) - Patched in: planned `2026.2.21` release</p> <p>### Impact Deployments relying on token/password for HTTP gateway routes could be downgraded to tokenless behavior when Tailscale header auth is enabled. This weakens expected HTTP route authentication boundaries even in trusted-host network setups.</p> <p>Per SECURITY.md, this does not affect the recommended setup: keep the Gateway loopback-only (or otherwise within a trusted host/network boundary), use Tailscale serve/funnel for remote access, and keep tokenless Tailscale auth scoped to Control UI websocket login.</p> <p>### Fix - Added an explicit auth-surface gate (`allowTailscaleHeaderAuth`, default `false`) in gateway auth. - Enabled tokenless Tailscale header auth only for Control UI websocket authentication. - Kept HTTP gateway auth call sites on token/password auth paths. - Added regression coverage for HTTP-vs-websocket behavior and Tailscale header handling.</p> <p>### Fix Commit(s) - `356d61aacfa5b0f1d5830716ec59d70682a3e7b8`</p> <p>### Release Process…</p> https://vulnerability.circl.lu/vuln/ghsa-hff7-ccv5-52f8