https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:25:45 +0000 https://vulnerability.circl.lu/vuln/cve-2026-45003 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.4.22 allows workspace dotenv files to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. Attackers with workspace access can redirect runtime traffic to malicious endpoints by setting endpoint variables in dotenv files.</p> https://vulnerability.circl.lu/vuln/cve-2026-45003 https://vulnerability.circl.lu/vuln/ghsa-55cf-xx38-4p9p <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Workspace dotenv files cannot override connector endpoint hosts.</p> <p>## Affected Packages / Versions - Package: openclaw (npm) - Affected versions: &lt;= 2026.4.21 - Fixed version: 2026.4.22</p> <p>## Impact A workspace .env file could set connector endpoint variables for Matrix, Mattermost, IRC, or Synology-related connectors and redirect runtime traffic away from the operator-configured endpoint.</p> <p>## Fix Workspace .env loading now blocks those endpoint variables, including per-account Matrix homeserver suffixes and generic base-url/API-host style overrides. Trusted global runtime dotenv loading remains separate.</p> <p>## Fix Commit(s) - 0623079e98abf7202591f1b04a89755eb7ec9272</p> <p>## Verification - The fix commit is contained in the public v2026.4.22 tag. - openclaw@2026.4.22 is published on npm and the compiled package contains the fix. - Focused regression coverage for this path passed before publication.</p> <p>OpenClaw thanks @qi-scape for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Workspace dotenv files cannot override connector endpoint hosts.</p> <p>## Affected Packages / Versions - Package: openclaw (npm) - Affected versions: &lt;= 2026.4.21 - Fixed version: 2026.4.22</p> <p>## Impact A workspace .env file could set connector endpoint variables for Matrix, Mattermost, IRC, or Synology-related connectors and redirect runtime traffic away from the operator-configured endpoint.</p> <p>## Fix Workspace .env loading now blocks those endpoint variables, including per-account Matrix homeserver suffixes and generic base-url/API-host style overrides. Trusted global runtime dotenv loading remains separate.</p> <p>## Fix Commit(s) - 0623079e98abf7202591f1b04a89755eb7ec9272</p> <p>## Verification - The fix commit is contained in the public v2026.4.22 tag. - openclaw@2026.4.22 is published on npm and the compiled package contains the fix. - Focused regression coverage for this path passed before publication.</p> <p>OpenClaw thanks @qi-scape for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-55cf-xx38-4p9p