https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:53:33 +0000 https://db.gcve.eu/vuln/cve-2026-41346 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing challenges on unaffected accounts, causing denial of service.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing challenges on unaffected accounts, causing denial of service.</p> https://db.gcve.eu/vuln/cve-2026-41346 https://db.gcve.eu/vuln/ghsa-wwfp-w96m-c6x8 <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Before OpenClaw 2026.3.31, pending pairing-request caps were enforced per channel file instead of per account. On multi-account channel setups, requests from other accounts could fill the shared pending window and block new pairing challenges on an unaffected account.</p> <p>## Impact</p> <p>This issue could deny new pairing or onboarding on another account until an existing request was approved or expired. It was an availability-only bug; it did not allow cross-account approval, data access, or authorization bypass.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&gt;= 2026.2.26, &lt; 2026.3.31` - Patched versions: `&gt;= 2026.3.31` - Latest published npm version: `2026.4.1`</p> <p>## Fix Commit(s)</p> <p>- `9bc1f896c8cd325dd4761681e9bdb8c425f69785` — scope pending request caps per account</p> <p>## Release Process Note</p> <p>The fix shipped in OpenClaw `2026.3.31` on March 31, 2026. The current published npm release `2026.4.1` from April 1, 2026 also contains the fix.</p> <p>Thanks @smaeljaish771 for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>## Summary</p> <p>Before OpenClaw 2026.3.31, pending pairing-request caps were enforced per channel file instead of per account. On multi-account channel setups, requests from other accounts could fill the shared pending window and block new pairing challenges on an unaffected account.</p> <p>## Impact</p> <p>This issue could deny new pairing or onboarding on another account until an existing request was approved or expired. It was an availability-only bug; it did not allow cross-account approval, data access, or authorization bypass.</p> <p>## Affected Packages / Versions</p> <p>- Package: `openclaw` (npm) - Affected versions: `&gt;= 2026.2.26, &lt; 2026.3.31` - Patched versions: `&gt;= 2026.3.31` - Latest published npm version: `2026.4.1`</p> <p>## Fix Commit(s)</p> <p>- `9bc1f896c8cd325dd4761681e9bdb8c425f69785` — scope pending request caps per account</p> <p>## Release Process Note</p> <p>The fix shipped in OpenClaw `2026.3.31` on March 31, 2026. The current published npm release `2026.4.1` from April 1, 2026 also contains the fix.</p> <p>Thanks @smaeljaish771 for reporting.</p> https://db.gcve.eu/vuln/ghsa-wwfp-w96m-c6x8