https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 09:57:04 +0000 https://vulnerability.circl.lu/vuln/cve-2026-100592 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw is an agent gateway distributed via npm. In versions &gt;= 2026.4.10 and &lt; 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent &#39;/dreaming on&#39; and &#39;/dreaming off&#39; commands to enable or disable the Gateway&#39;s Memory Core dreaming behavior, disabling background memory processing or re-enabling durable memory promotion where the owner expected it to remain disabled; the practical confidentiality, integrity, and availability impact depends on stored conversation material and subsequent memory use. Read-only status and help commands remain governed by normal command policy. The issue is fixed in version 2026.7.1. As a workaround, disable dreaming commands in external channels or restrict channel command access to owners.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw is an agent gateway distributed via npm. In versions &gt;= 2026.4.10 and &lt; 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent &#39;/dreaming on&#39; and &#39;/dreaming off&#39; commands to enable or disable the Gateway&#39;s Memory Core dreaming behavior, disabling background memory processing or re-enabling durable memory promotion where the owner expected it to remain disabled; the practical confidentiality, integrity, and availability impact depends on stored conversation material and subsequent memory use. Read-only status and help commands remain governed by normal command policy. The issue is fixed in version 2026.7.1. As a workaround, disable dreaming commands in external channels or restrict channel command access to owners.</p> https://vulnerability.circl.lu/vuln/cve-2026-100592