3 matches found
CVE-2026-100553 OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin
OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...
CVE-2026-100553 OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin
OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...
CVE-2026-100553 OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin
OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...