CVE-2026-94220

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

EUVD-2026-90766

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-94220

A Cross-Site request forgery (CSRF) vulnerability exists in the feishu-auth and dingtalk-auth plugins within Apache APISIX (versions 3.17.0 through 3.18.0 ). This flaw allows an attacker to trick a user into clicking a crafted link, causing the user's browser session on a protected route to be es...

CVE-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-100553

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...

CVE-2026-100540

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

EUVD-2026-87497

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...

CVE-2026-100553 OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...

CVE-2026-100553 OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...

CVE-2026-100553

OpenClaw versions >= 2026.6.9 and

CVE-2026-100553 OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...

CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100540

Versions of OpenClaw Feishu prior to 2026.8.1 are vulnerable to an authentication bypass because the system fails to verify if a configured default account is disabled before using it for model tool operations. In multi-account configurations, an attacker can exploit a disabled default account th...

EUVD-2026-87510

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100540: Incorrect Authorization

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

PT-2026-99218

Name of the Vulnerable Software and Affected Versions @openclaw/msteams versions prior to 2026.8.1 @openclaw/feishu versions prior to 2026.8.1 @openclaw/matrix versions prior to 2026.8.1 @openclaw/googlechat versions prior to 2026.8.1 Description Channel plugins fail to enforce the configured...

CVE-2026-100553: Incorrect Authorization

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...