BIT-AIRFLOW-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

BIT-AIRFLOW-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-100556

OpenClaw npm package openclaw versions = 2026.5.2 and command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session,...

CVE-2026-100545

OpenClaw npm package openclaw before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filena...

CVE-2026-100535

OpenClaw npm package 'openclaw' versions = 2026.4.5 and 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender...

CVE-2026-100528

OpenClaw npm package 'openclaw' before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a mod...

CVE-2026-100534

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's...

CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels

OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...

CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels

OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...

CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels

OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...

CVE-2026-100556 OpenClaw before 2026.8.1 Authentication Bypass via Session Reset

OpenClaw npm package openclaw versions = 2026.5.2 and command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session,...

CVE-2026-100556 OpenClaw before 2026.8.1 Authentication Bypass via Session Reset

OpenClaw npm package openclaw versions = 2026.5.2 and command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session,...

CVE-2026-100556

OpenClaw npm package openclaw versions = 2026.5.2 and command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session,...

CVE-2026-100556 OpenClaw before 2026.8.1 Authentication Bypass via Session Reset

OpenClaw npm package openclaw versions = 2026.5.2 and command to reset the shared group session and persist a provider and model override. This allows a command-denied group member to select a provider and model already permitted by the operator for subsequent turns in the shared group session,...

CVE-2026-100551 OpenClaw iOS Control UI TLS Pin Enforcement Bypass

OpenClaw for iOS versions = 2026.7.1 and 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an...

CVE-2026-100545

OpenClaw npm package "openclaw" before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory...

CVE-2026-100545 OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation

OpenClaw npm package openclaw before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filena...

CVE-2026-100545 OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation

OpenClaw npm package openclaw before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filena...

EUVD-2026-87505

OpenClaw npm package openclaw before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filena...

CVE-2026-100545

The OpenClaw (npm package openclaw) before version 2026.8.1 contains a vulnerability where it incorrectly enforces sender tool policies during session-memory filename generation . In affected versions, the generation process creates an embedded helper that retains tools even if the originating se...