Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the connect process. An attacker can initiate unauthorized connections to arbitrary URLs using credentials IDs of their choosing by tricking a user into performing unwanted actions while authenticated...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to a missing permission check in the connect process. An attacker can initiate unauthorized connections to arbitrary URLs by supplying crafted credentials, potentially exposing sensitive information or...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to a lack of permission checks in the connect process. An attacker can exfiltrate credentials by specifying a malicious URL and leveraging credential IDs obtained through other means. Remediation There is no...

Information Exposure

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Information Exposure via the connect process. An attacker can obtain sensitive host filesystem paths and deployment metadata by making authenticated requests as a non-admin client...