https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 18:31:55 +0000 https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-45006 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>The agent-facing `gateway` tool protects `config.apply` and `config.patch` with a model-to-operator trust boundary. That guard used a hand-maintained denylist of protected config paths. The config schema outgrew that denylist, leaving sensitive subtrees writable through model-driven gateway config mutations.</p> <p>## Impact</p> <p>A prompt-injected or otherwise compromised model running with access to the owner-only `gateway` tool could persist unsafe config changes that crossed security boundaries. Examples included config paths affecting command execution, network/proxy/TLS behavior, credential forwarding, telemetry or hook endpoints, memory/indexing surfaces, and operator policy controls. These changes could survive restart once written to config.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` on npm - Affected: versions before `2026.4.23` - Fixed: `2026.4.23` - Latest stable verified fixed: `openclaw@2026.4.23`, tag `v2026.4.23`</p> <p>## Fix</p> <p>OpenClaw replaced the denylist with a fail-closed allowlist. Agent-driven `gateway config.apply` and `gateway config.patch` now permit only narrow agent-tunable prompt/model settings and mention-gating paths. Other config changes are rejected before the gateway mutation RPC is invoked.</p> <p>## Fix Commit(s)</p> <p>- `bceda6089aa7b3695cc7696b43c61ae3d01bb0ec` (`fix(gateway): fail closed on runtime config edits`)</p> <p>## Severity</p> <p>Severity remains `high`. The vulnerable entry point is owner-only, but the model/agent is not a trusted principal…</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>## Summary</p> <p>The agent-facing `gateway` tool protects `config.apply` and `config.patch` with a model-to-operator trust boundary. That guard used a hand-maintained denylist of protected config paths. The config schema outgrew that denylist, leaving sensitive subtrees writable through model-driven gateway config mutations.</p> <p>## Impact</p> <p>A prompt-injected or otherwise compromised model running with access to the owner-only `gateway` tool could persist unsafe config changes that crossed security boundaries. Examples included config paths affecting command execution, network/proxy/TLS behavior, credential forwarding, telemetry or hook endpoints, memory/indexing surfaces, and operator policy controls. These changes could survive restart once written to config.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` on npm - Affected: versions before `2026.4.23` - Fixed: `2026.4.23` - Latest stable verified fixed: `openclaw@2026.4.23`, tag `v2026.4.23`</p> <p>## Fix</p> <p>OpenClaw replaced the denylist with a fail-closed allowlist. Agent-driven `gateway config.apply` and `gateway config.patch` now permit only narrow agent-tunable prompt/model settings and mention-gating paths. Other config changes are rejected before the gateway mutation RPC is invoked.</p> <p>## Fix Commit(s)</p> <p>- `bceda6089aa7b3695cc7696b43c61ae3d01bb0ec` (`fix(gateway): fail closed on runtime config edits`)</p> <p>## Severity</p> <p>Severity remains `high`. The vulnerable entry point is owner-only, but the model/agent is not a trusted principal…</p> https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-45006