CVE-2026-100585

OpenClaw npm package openclaw before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request...

CVE-2026-100585

The OpenClaw npm package (openclaw) versions prior to 2026.7.1 contains an authorization bypass vulnerability. The software fails to enforce an owner-only requirement for Claude Code permission prompts sent via the MCP channel bridge . This allows an authorized non-owner channel sender with comma...

CVE-2026-100585

OpenClaw npm package "openclaw" before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission reques...

EUVD-2026-87466

OpenClaw npm package openclaw before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request...

PT-2026-99221

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description The openclaw npm package fails to enforce owner-only authorization for Claude Code permission prompts sent via the MCP channel bridge. This allows an authorized non-owner with channel command...

CVE-2026-100585: Missing Authorization

OpenClaw npm package openclaw before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request...

CVE-2026-13591

DeepMyst Mysti 0.4.0 is affected by a vulnerability in the Contact Tracking module: the function _isTrackedConversation in ChannelBridge.ts can be manipulated via the _channelType argument, causing improper authorization. Access may be possible remotely, with attack complexity described as high a...

CVE-2026-13591 DeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation improper authorization

A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function isTrackedConversation of the file src/managers/ChannelBridge.ts of the component Contact Tracking. This manipulation of the argument channelType causes improper authorization. The attack may be initiated remotely. A...

PT-2026-53320

A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function isTrackedConversation of the file src/managers/ChannelBridge.ts of the component Contact Tracking. This manipulation of the argument channelType causes improper authorization. The attack may be initiated remotely. A...

ppp: do not assume bh is held in ppp_channel_bridge_input()

...

DEBIAN-CVE-2024-49946

In the Linux kernel, the following vulnerability has been resolved: ppp: do not assume bh is held in pppchannelbridgeinput Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in the socket backlog is the...

PT-2024-33788

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability has been resolved in the Linux kernel where the ppp channel bridge input function did not consider the case when the socket lock is acquired and packets are stored in the sock...