PT-2026-35804

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attackers with operator.write permissions can bypass pairi...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.28 contained security vulnerabilities. These vulnerabilities stemmed from permission escalation vulnerabilities, allowing authenticated operators with write permissions to acces...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.8 contained security vulnerabilities. These vulnerabilities stemmed from an issue with the permission escalation mechanism in the gateway plugin’s HTTP authentication process...

GHSA-GJ49-89WH-H4GJ vulnerabilities

Vulnerabilities for packages: hubble-ui, kubescape, kubescape-operator...

CVE-2026-41520 vulnerabilities

Vulnerabilities for packages: hubble-ui, kubescape, kubescape-operator...

GHSA-GJ49-89WH-H4GJ vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, kubescape-operator-fips, hubble-fips, kubescape-server, kubescape-operator, hubble-ui-backend-fips, kubescape, hubble-ui...

CVE-2026-41520 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, kubescape-operator-fips, hubble-fips, kubescape-server, kubescape-operator, hubble-ui-backend-fips, kubescape, hubble-ui...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges due to the Mint-mode process. An attacker can gain account-wide permissions and perform destructive actions beyond the intended cluster scope by compromising operator credentials. Workaround This...

OpenClaw: Agent gateway config mutations could change protected operator settings

Affected Packages / Versions - Package: openclaw npm - Affected versions: 2026.4.20 - Patched version: 2026.4.20 Impact The agent-facing gateway config.patch / config.apply guard did not cover several operator-trusted settings, including sandbox policy, plugin enablement, gateway auth/TLS, hook...

NPM: OpenClaw: Agent gateway config mutations could change protected operator settings

NPM: OpenClaw: Agent gateway config mutations could change protected operator settings vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.20...

Insufficient Granularity of Access Control

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Granularity of Access Control via insufficient access control in the gateway config.patch and config.apply processes. An attacker can modify protected operator settings by...

GHSA-7JM2-G593-4QRC OpenClaw: Agent gateway config mutations could change protected operator settings

Affected Packages / Versions - Package: openclaw npm - Affected versions: 2026.4.20 - Patched version: 2026.4.20 Impact The agent-facing gateway config.patch / config.apply guard did not cover several operator-trusted settings, including sandbox policy, plugin enablement, gateway auth/TLS, hook...

OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization

Affected Packages / Versions - Package: openclaw npm - Affected versions: 2026.4.20 - Patched version: 2026.4.20 Impact The Control UI assistant-media route authenticated trusted-proxy callers but did not enforce the declared operator scopes for identity-bearing HTTP auth paths. A trusted-proxy...

GHSA-V8QF-FR4G-28P2 OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization

Affected Packages / Versions - Package: openclaw npm - Affected versions: 2026.4.20 - Patched version: 2026.4.20 Impact The Control UI assistant-media route authenticated trusted-proxy callers but did not enforce the declared operator scopes for identity-bearing HTTP auth paths. A trusted-proxy...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: kyverno, crossplane-provider-aws-s3, kargo, vexctl, crossplane-provider-azure-securityinsights, crossplane-provider-aws-rds, rke2-runtime-fips, crossplane-provider-aws-cognitoidp-fips, haproxy-ingress, blob-csi-fips, vertical-pod-autoscaler-fips,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: kyverno, crossplane-provider-aws-s3, kargo, vexctl, crossplane-provider-azure-securityinsights, crossplane-provider-aws-rds, rke2-runtime-fips, crossplane-provider-aws-cognitoidp-fips, haproxy-ingress, blob-csi-fips, vertical-pod-autoscaler-fips,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: trivy, kubernetes-csi-driver-nfs, node-problem-detector, external-dns, kuberay-operator, crossplane-provider-aws-memorydb, step-issuer, mesosphere-vsphere-csi, crossplane-provider-aws-elasticache, haproxy-ingress, crossplane-provider-azure-authorization,...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: trivy, kubernetes-csi-driver-nfs, node-problem-detector, external-dns, kuberay-operator, crossplane-provider-aws-memorydb, step-issuer, mesosphere-vsphere-csi, crossplane-provider-aws-elasticache, haproxy-ingress, crossplane-provider-azure-authorization,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: juicefs, trufflehog, nuclei, terraform, percona-server-mongodb-operator, cert-manager-cmctl, minio, rancher, opentofu, spqr, gitea, dex, rancher-agent, grafana, frp, xeol, yunikorn-k8shim, harbor, k6, external-secrets-operator, rancher-webhook, cert-manager-csi-drive...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: juicefs, trufflehog, nuclei, terraform, percona-server-mongodb-operator, cert-manager-cmctl, minio, rancher, opentofu, spqr, gitea, dex, rancher-agent, grafana, frp, xeol, yunikorn-k8shim, harbor, k6, external-secrets-operator, rancher-webhook, cert-manager-csi-drive...