https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 17:53:58 +0000 https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-53809 <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>Embedded runner policy could be confused by provider aliases. In affected versions, a request using provider aliases could compare policy against an alias instead of the canonical provider identity.</p> <p>This advisory is scoped to the named feature and configuration. It does not change OpenClaw&#39;s trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.</p> <p>### Impact</p> <p>When the affected feature is enabled and reachable, this could select bundled tool access outside the intended provider policy. Practical impact depends on the operator&#39;s configuration and whether lower-trust input can reach that path.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.4.25`.</p> <p>### Mitigations</p> <p>Avoid provider alias routing for embedded runner tool policy until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.</p> <p><strong>Affected:</strong> Homebrew: openclaw-cli</p> <p>### Summary</p> <p>Embedded runner policy could be confused by provider aliases. In affected versions, a request using provider aliases could compare policy against an alias instead of the canonical provider identity.</p> <p>This advisory is scoped to the named feature and configuration. It does not change OpenClaw&#39;s trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.</p> <p>### Impact</p> <p>When the affected feature is enabled and reachable, this could select bundled tool access outside the intended provider policy. Practical impact depends on the operator&#39;s configuration and whether lower-trust input can reach that path.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.4.25`.</p> <p>### Mitigations</p> <p>Avoid provider alias routing for embedded runner tool policy until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.</p> https://db.gcve.eu/vuln/brew-openclaw-cli-cve-2026-53809 https://db.gcve.eu/vuln/cve-2026-53809 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider policy restrictions when the affected feature is enabled.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled tool access outside intended provider policy restrictions when the affected feature is enabled.</p> https://db.gcve.eu/vuln/cve-2026-53809