https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 09:35:51 +0000 https://db.gcve.eu/vuln/cve-2026-40045 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attackers can forge discovery results or craft setup codes to redirect clients to malicious endpoints, disclosing plaintext gateway credentials.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attackers can forge discovery results or craft setup codes to redirect clients to malicious endpoints, disclosing plaintext gateway credentials.</p> https://db.gcve.eu/vuln/cve-2026-40045 https://db.gcve.eu/vuln/ghsa-83f3-hh45-vfw9 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext `ws://` gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint.</p> <p>## Impact</p> <p>A user who followed a forged discovery result or scanned a crafted setup code could disclose stored gateway credentials to an attacker-controlled endpoint in plaintext. This was a transport-security bug in the Android gateway client.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.4.1` - Patched versions: `&gt;= 2026.4.2` - Latest published npm version: `2026.4.1`</p> <p>## Fix Commit(s)</p> <p>- `a941a4fef9bc43b2973c92d0dcff5b8a426210c5` — require TLS for remote Android gateway endpoints</p> <p>## Release Process Note</p> <p>The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.</p> <p>Thanks @zsxsoft for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext `ws://` gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint.</p> <p>## Impact</p> <p>A user who followed a forged discovery result or scanned a crafted setup code could disclose stored gateway credentials to an attacker-controlled endpoint in plaintext. This was a transport-security bug in the Android gateway client.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.4.1` - Patched versions: `&gt;= 2026.4.2` - Latest published npm version: `2026.4.1`</p> <p>## Fix Commit(s)</p> <p>- `a941a4fef9bc43b2973c92d0dcff5b8a426210c5` — require TLS for remote Android gateway endpoints</p> <p>## Release Process Note</p> <p>The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.</p> <p>Thanks @zsxsoft for reporting.</p> https://db.gcve.eu/vuln/ghsa-83f3-hh45-vfw9