{"vulnerability": "cve-2026-10057", "sightings": [{"uuid": "1b0c4d8f-2958-4ff7-8e9d-e559bfba0a3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-10057", "type": "seen", "source": "https://www.twcert.org.tw/en/cp-139-10942-2b78b-2.html", "content": "", "creation_timestamp": "2026-05-29T01:15:00.000000Z"}, {"uuid": "e3f50c60-4118-4c19-9065-4a368ae4b143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100575", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117335459461034947", "content": "CVE-2026-100575 | HIGH severity | OpenClaw Slack (<2026.8.1): Missing authorization in multi-person DMs lets unauthorized users trigger Slack agents and access restricted tools/data. Patch to 2026.8.1+ now. https://radar.offseq.com/threat/cve-2026-100575-missing-authorization-in-openclaw-slack-2a3447a3c9192e9f #OffSeq #Vuln #Infosec #Slack", "creation_timestamp": "2026-09-26T04:30:26.251206Z"}, {"uuid": "3cd09c7c-c06b-409d-944a-4cbce26ad9de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100575", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwfh7gpzhk2q", "content": "OpenClaw Slack (<2026.8.1) faces HIGH severity (CVSS 8.7) auth bypass in multi-person DMs \u2014 unauthorized users can trigger Slack agents. Upgrade to 2026.8.1+ to secure your data. https://radar.offseq.com/threat/cve-2026-100575-missing-authorization-in-openclaw-slack-2a3447a3c9192e9f #OffSeq #Vuln...", "creation_timestamp": "2026-09-26T04:30:28.356336Z"}, {"uuid": "35d1637a-16b2-4a3f-98d0-087a60cfd9d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100575", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwfixraw2p25", "content": "Daily IT Security Digest \u2014 2026-09-26\napplied. [Source](https://radar.offseq.com/threat/cve-2026-18467-paytium)\n\n7. **OpenClaw Security Suite \u2014 Multiple Vulnerabilities Patched**\n   OpenClaw released multiple fixes addressing several security issues: CVE-2026-100575 (HIGH, missing authorization in", "creation_timestamp": "2026-09-26T05:01:57.584900Z"}, {"uuid": "c32fe75f-6ef1-43b2-a9ca-bf471911cd35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-100575", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwfixrssdc2x", "content": "Daily IT Security Digest \u2014 2026-09-26\nOpenClaw users should upgrade to version 2026.9.3 or later immediately. [Source](https://radar.offseq.com/threat/cve-2026-100575-missing-auth)\n\n8. **Ransomware Group Orova Publishes New Victims**\n   Ransomware group Orova has published three new alleged victim", "creation_timestamp": "2026-09-26T05:01:58.659015Z"}, {"uuid": "ad87d2ca-a831-4897-8798-15d036d7a884", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100575", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwflkaj46z2c", "content": "\ud83d\udfe0 CVE-2026-100575 - High (8.8)\n\nOpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-perso...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100575/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T05:48:06.463353Z"}, {"uuid": "a991a17a-dfde-48cf-82df-551fa0b82d85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100578", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwflli7nim27", "content": "\ud83d\udfe0 CVE-2026-100578 - High (7.6)\n\nOpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure too...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100578/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T05:48:47.980309Z"}, {"uuid": "ff396ab8-0d08-46dd-be24-ba5872f8abc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100579", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfllphdqt2c", "content": "\ud83d\udfe0 CVE-2026-100579 - High (7.6)\n\nOpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in mess...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100579/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T05:48:55.528896Z"}, {"uuid": "0f8e5b99-b572-4102-931d-ad07475756ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100570", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfo2ntm7n26", "content": "\ud83d\udfe0 CVE-2026-100570 - High (7.8)\n\nOpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted work...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-100570/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T06:33:04.644103Z"}, {"uuid": "a963a9e3-0c88-4516-af95-3e481494bc58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-100575", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwh5fb53pw2r", "content": "CVE-2026-100575 - slack\nOlder versions of OpenClaw Slack let people who aren\u2019t supposed to be in a group direct message trick the system into acting as if they were authorized. This can give them access to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#slack #openclaw #CVE #infosec", "creation_timestamp": "2026-09-26T20:40:05.310613Z"}]}