https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 17:55:54 +0000 https://db.gcve.eu/vuln/cve-2026-41339 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. Non-admin clients can recover host-specific filesystem paths and deployment details, enabling host fingerprinting and facilitating chained attacks.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. Non-admin clients can recover host-specific filesystem paths and deployment details, enabling host fingerprinting and facilitating chained attacks.</p> https://db.gcve.eu/vuln/cve-2026-41339 https://db.gcve.eu/vuln/ghsa-2f7j-rp58-mr42 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Before OpenClaw 2026.4.2, the Gateway `connect` success snapshot exposed local `configPath` and `stateDir` metadata to non-admin clients. Low-privilege authenticated clients could learn host filesystem layout and deployment details that were not needed for their role.</p> <p>## Impact</p> <p>A non-admin client could recover host-specific filesystem paths and related deployment metadata, aiding host fingerprinting and chained attacks. This was an information-disclosure issue, not a direct authorization bypass.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.4.1` - Patched versions: `&gt;= 2026.4.2` - Latest published npm version: `2026.4.1`</p> <p>## Fix Commit(s)</p> <p>- `676b748056b5efca6f1255708e9dd9469edf5e2e` — limit connect snapshot metadata to admin-scoped clients</p> <p>## Release Process Note</p> <p>The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.</p> <p>Thanks @topsec-bunney for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Before OpenClaw 2026.4.2, the Gateway `connect` success snapshot exposed local `configPath` and `stateDir` metadata to non-admin clients. Low-privilege authenticated clients could learn host filesystem layout and deployment details that were not needed for their role.</p> <p>## Impact</p> <p>A non-admin client could recover host-specific filesystem paths and related deployment metadata, aiding host fingerprinting and chained attacks. This was an information-disclosure issue, not a direct authorization bypass.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&lt;= 2026.4.1` - Patched versions: `&gt;= 2026.4.2` - Latest published npm version: `2026.4.1`</p> <p>## Fix Commit(s)</p> <p>- `676b748056b5efca6f1255708e9dd9469edf5e2e` — limit connect snapshot metadata to admin-scoped clients</p> <p>## Release Process Note</p> <p>The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.</p> <p>Thanks @topsec-bunney for reporting.</p> https://db.gcve.eu/vuln/ghsa-2f7j-rp58-mr42