Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization in the agent process when the /reset or /new endpoints are accessed with only operator.write permissions. An attacker can gain unauthorized administrative access by...

Improper Authentication

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Authentication via the authorizeCanvasRequest function. An attacker can gain unauthorized access to HTTP and WebSocket endpoints by sending local-direct loopback requests that...

@agentholdings/agent-passport (=0.1.0), @flomesh/ztm-chat (>=2026.3.25 <=2026.3.26) +8 more potentially affected by CVE-2026-35618 via openclaw (>=0.0.1 <=2026.3.23-2)

openclaw NPM version =0.0.1, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =3.3.2, =3.3.7 Source cves: CVE-2026-35618 Source advisory: OSV:GHSA-CG6C-Q2HX-69H7...