NPM: OpenClaw: memory-wiki ingest could read local files with operator.write scope

NPM: OpenClaw: memory-wiki ingest could read local files with operator.write scope vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.12...

OpenClaw: memory-wiki ingest could read local files with operator.write scope

Summary memory-wiki ingest could read local files with operator.write scope. In affected versions, a Gateway caller with operator.write access to the plugin tool could read arbitrary local file paths instead of staying within the intended ingest sources. This advisory is scoped to the named featu...

GHSA-P2FH-F5FC-44HR OpenClaw: memory-wiki ingest could read local files with operator.write scope

Summary memory-wiki ingest could read local files with operator.write scope. In affected versions, a Gateway caller with operator.write access to the plugin tool could read arbitrary local file paths instead of staying within the intended ingest sources. This advisory is scoped to the named featu...

OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates

Summary Some internal command handlers require operator.approvals or operator.admin scopes. In affected releases, a scoped Gateway chat.send request delivered through an inherited external route could be evaluated as an external-channel command while still carrying the lower Gateway client scopes...

OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

Summary Marketplace runtime extension metadata could point at unscanned payloads. In affected versions, a package selected for installation by a trusted operator could redirect runtime loading toward hidden package content that was not scanned as expected. This advisory is scoped to the named...

GHSA-V6R2-JH58-XX6W OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

Summary Marketplace runtime extension metadata could point at unscanned payloads. In affected versions, a package selected for installation by a trusted operator could redirect runtime loading toward hidden package content that was not scanned as expected. This advisory is scoped to the named...

GHSA-9R4W-JG96-92MV vulnerabilities

Vulnerabilities for packages: teleport-operator-fips, tbot, teleport...

CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: tigera-operator, chartmuseum-fips, crossplane, linkerd2, crossplane-fips, cluster-api-helm-controller-fips, xeol, eksctl, kubescape-operator-fips, gitness, argocd-image-updater-fips, kgateway, kyverno, falcoctl, kube-mgmt-fips, helm-exporter, ocm-cli, kube-mgmt,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: tigera-operator, chartmuseum-fips, crossplane, linkerd2, crossplane-fips, cluster-api-helm-controller-fips, xeol, eksctl, kubescape-operator-fips, gitness, argocd-image-updater-fips, kgateway, kyverno, falcoctl, kube-mgmt-fips, helm-exporter, ocm-cli, kube-mgmt,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: tigera-operator, chartmuseum-fips, crossplane, linkerd2, crossplane-fips, cluster-api-helm-controller-fips, xeol, eksctl, kubescape-operator-fips, gitness, argocd-image-updater-fips, kgateway, kyverno, falcoctl, kube-mgmt-fips, helm-exporter, ocm-cli, kube-mgmt,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: tigera-operator, chartmuseum-fips, crossplane, linkerd2, crossplane-fips, cluster-api-helm-controller-fips, xeol, eksctl, kubescape-operator-fips, gitness, argocd-image-updater-fips, kgateway, kyverno, falcoctl, kube-mgmt-fips, helm-exporter, ocm-cli, kube-mgmt,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: tigera-operator, chartmuseum-fips, crossplane, linkerd2, crossplane-fips, cluster-api-helm-controller-fips, xeol, eksctl, kubescape-operator-fips, gitness, argocd-image-updater-fips, kgateway, kyverno, falcoctl, kube-mgmt-fips, helm-exporter, ocm-cli, kube-mgmt,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: tigera-operator, chartmuseum-fips, crossplane, linkerd2, crossplane-fips, cluster-api-helm-controller-fips, xeol, eksctl, kubescape-operator-fips, gitness, argocd-image-updater-fips, kgateway, kyverno, falcoctl, kube-mgmt-fips, helm-exporter, ocm-cli, kube-mgmt,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: tigera-operator, chartmuseum-fips, crossplane, linkerd2, crossplane-fips, cluster-api-helm-controller-fips, xeol, eksctl, kubescape-operator-fips, gitness, argocd-image-updater-fips, kgateway, kyverno, falcoctl, kube-mgmt-fips, helm-exporter, ocm-cli, kube-mgmt,...

PT-2026-55423

Summary Combined POSIX shell options could confuse exec revalidation. In affected versions, a command request using combined shell flags could parse approval-time and execution-time shell options differently. This advisory is scoped to the named feature and configuration. It does not change...

PT-2026-55382

Summary Workspace .env could override Homebrew executable selection for skill install flows. In affected versions, a workspace .env in a repository opened by a trusted operator could override the Homebrew executable used by the install helper. This advisory is scoped to the named feature and...

PT-2026-55406

Summary Embedded runner policy could be confused by provider aliases. In affected versions, a request using provider aliases could compare policy against an alias instead of the canonical provider identity. This advisory is scoped to the named feature and configuration. It does not change...

CVE-2026-49835 vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains, trivy-operator, goreleaser, ratify, kyverno-notation-aws, crossplane, kubescape, kyverno, gitsign, falcoctl, spire-server, zarf, tflint, trivy, policy-controller, aactl, neuvector-sigstore-interface...

GHSA-9C54-X2G4-V92J vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains, trivy-operator, goreleaser, ratify, kyverno-notation-aws, crossplane, kubescape, kyverno, gitsign, falcoctl, spire-server, zarf, tflint, trivy, policy-controller, aactl, neuvector-sigstore-interface...

Critical: Red Hat Security Advisory: Cluster Observability Operator 1.5.0

The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.5 release of COO...