https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 21:57:25 +0000 https://db.gcve.eu/vuln/cve-2026-53821 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execute admin-gated Gateway RPCs.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execute admin-gated Gateway RPCs.</p> https://db.gcve.eu/vuln/cve-2026-53821 https://db.gcve.eu/vuln/ghsa-qjpc-qf9m-xwmr <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>In trusted-proxy Control UI mode, OpenClaw accepted a WebSocket client&#39;s declared operator scopes before those scopes were bound to a server-approved pairing or trusted-proxy authorization baseline.</p> <p>This issue affects trusted-proxy Control UI deployments. It does not apply to shared-secret Control UI sessions, which are treated as trusted operator sessions by design.</p> <p>### Affected configurations</p> <p>This affects deployments using `gateway.auth.mode: &#34;trusted-proxy&#34;` for Control UI access where a restricted trusted-proxy user could open a Control UI WebSocket and present a fresh, unpaired device identity with elevated requested scopes.</p> <p>### Impact</p> <p>An unpaired or restricted trusted-proxy Control UI client could obtain cached `operator.admin` authority on its live WebSocket connection. That authority could then be used for admin-gated Gateway RPCs until the connection was closed or revalidated.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Before upgrading, restrict trusted-proxy Control UI access to users who should have the scopes they can request, and restart the gateway after changing trusted-proxy authorization policy.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>In trusted-proxy Control UI mode, OpenClaw accepted a WebSocket client&#39;s declared operator scopes before those scopes were bound to a server-approved pairing or trusted-proxy authorization baseline.</p> <p>This issue affects trusted-proxy Control UI deployments. It does not apply to shared-secret Control UI sessions, which are treated as trusted operator sessions by design.</p> <p>### Affected configurations</p> <p>This affects deployments using `gateway.auth.mode: &#34;trusted-proxy&#34;` for Control UI access where a restricted trusted-proxy user could open a Control UI WebSocket and present a fresh, unpaired device identity with elevated requested scopes.</p> <p>### Impact</p> <p>An unpaired or restricted trusted-proxy Control UI client could obtain cached `operator.admin` authority on its live WebSocket connection. That authority could then be used for admin-gated Gateway RPCs until the connection was closed or revalidated.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>Upgrade to `openclaw@2026.5.18` or later. Before upgrading, restrict trusted-proxy Control UI access to users who should have the scopes they can request, and restart the gateway after changing trusted-proxy authorization policy.</p> https://db.gcve.eu/vuln/ghsa-qjpc-qf9m-xwmr