https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 23:51:50 +0000 https://db.gcve.eu/vuln/cve-2026-35648 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy tightening to execute unauthorized commands.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy tightening to execute unauthorized commands.</p> https://db.gcve.eu/vuln/cve-2026-35648 https://db.gcve.eu/vuln/ghsa-wj55-88gf-x564 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Queued node actions were not revalidated against current command policy when later delivered, so stale allowlists or declarations could survive policy tightening.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: &lt; 2026.3.22 - Fixed: &gt;= 2026.3.22 - Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) - Latest published npm version checked: `2026.3.23-2`</p> <p>## Fix Commit(s) - `ec2c6d83b9f5f91d6d9094842e0f19b88e63e3e2`</p> <p>## Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.</p> <p>## Code-Level Confirmation - src/gateway/server-methods/nodes.ts now revalidates queued actions against the current allowlist and declared command set at delivery time. - src/gateway/server-methods/nodes.invoke-wake.test.ts includes the shipped stale-queue regression coverage.</p> <p>OpenClaw thanks @zpbrent for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary Queued node actions were not revalidated against current command policy when later delivered, so stale allowlists or declarations could survive policy tightening.</p> <p>## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: &lt; 2026.3.22 - Fixed: &gt;= 2026.3.22 - Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`) - Latest published npm version checked: `2026.3.23-2`</p> <p>## Fix Commit(s) - `ec2c6d83b9f5f91d6d9094842e0f19b88e63e3e2`</p> <p>## Release Status The fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.</p> <p>## Code-Level Confirmation - src/gateway/server-methods/nodes.ts now revalidates queued actions against the current allowlist and declared command set at delivery time. - src/gateway/server-methods/nodes.invoke-wake.test.ts includes the shipped stale-queue regression coverage.</p> <p>OpenClaw thanks @zpbrent for reporting.</p> https://db.gcve.eu/vuln/ghsa-wj55-88gf-x564