CVE-2026-100543 OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash

OpenClaw npm package openclaw before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as...

CVE-2026-100543

The OpenClaw npm package (version openclaw before 2026.8.1 ) is vulnerable to information disclosure because it includes deterministic hashes computed over original, unredacted configurations within redacted configuration responses. If the Gateway password has low entropy and other configuration ...

CVE-2026-100543: Exposure of Sensitive Information to an Unauthorized Actor

OpenClaw npm package openclaw before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as...

PT-2026-99217

Name of the Vulnerable Software and Affected Versions OpenClaw for iOS versions prior to 2026.8.11 Description The application stores Gateway credentials as cleartext JSON within App Group UserDefaults rather than using the secure device Keychain. This allows attackers who obtain unencrypted devi...

GHSA-W7C2-W76W-5HMJ vulnerabilities

Vulnerabilities for packages: kubescape-operator, hubble-ui, cilium, kubescape, hubble...

CLEANSTART-2026-NE14632 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-DS09618 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

The vulnerability of the Perl-DBI interface for connecting to and working with databases involves the use of an erroneous operator, which allows attackers to cause service failures.

The vulnerability of the Perl-DBI interface for connecting to and working with databases is related to the use of an erroneous operator. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2026-105222

Security vulnerability affects the prometheus-operator package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-YE46626 Previously, a channel registered in the mux's chanList is not usable until it is established

Security vulnerability affects the helm-operator package. Previously, a channel registered in the mux's chanList is not usable until it is established...

CLEANSTART-2026-LY26617 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the helm-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

CLEANSTART-2026-QY50458 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the fluent-operator package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2026-JD49945 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

Security vulnerability affects the fluent-operator package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CLEANSTART-2026-HW83607 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the fluent-operator package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CLEANSTART-2026-RJ45825 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Security vulnerability affects the fluent-operator package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CLEANSTART-2026-JR87567 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

Security vulnerability affects the fluent-operator package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

CLEANSTART-2026-FI79899 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Security vulnerability affects the fluent-operator package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

CLEANSTART-2026-BO10826 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Security vulnerability affects the fluent-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...

CLEANSTART-2026-BL26881 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the fluent-operator package. Previously, resolving relative paths containing parent directory '...

PT-2026-105237

Security vulnerability affects the helm-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...