OpenClaw: Empty approver lists could grant explicit approval authorization

Summary Empty approver lists could grant explicit approval authorization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.12 Impact For helper-backed channels, an empty resolved approver list could be interpreted as explicit approval authorization,...

PT-2026-35594

Summary Empty approver lists could grant explicit approval authorization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.12 Impact For helper-backed channels, an empty resolved approver list could be interpreted as explicit approval authorization,...

CVE-2025-4143

The CVE-2025-4143 entry concerns the OAuth implementation in Cloudflare’s workers-oauth-provider (MCP framework). The root cause is missing validation of redirect_uri against the client’s allowed list during authorization (the server-side code only validated the code exchange). This creates poten...