EUVD-2026-87472

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

CVE-2026-100579

The OpenClaw (npm package 'openclaw ') before version 2026.7.1 is vulnerable to an authentication bypass because it incorrectly trusts requester provenance in message.action . In identity-bearing Gateway deployments, a write-scoped caller can provide a different sender's identifier to bypass chan...

CVE-2026-100579

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

CVE-2026-100579 OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

CVE-2026-100544

openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller...

CVE-2026-100541

OpenClaw's Matrix integration npm package @openclaw/matrix versions = 2026.2.2 and 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matr...

EUVD-2026-87509

OpenClaw's Matrix integration npm package @openclaw/matrix versions = 2026.2.2 and 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matr...

CVE-2026-100541

The @openclaw/matrix npm package (versions >= 2026.2.2 and

CVE-2026-100541 OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding

OpenClaw's Matrix integration npm package @openclaw/matrix versions = 2026.2.2 and 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matr...

CVE-2026-100541 OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding

OpenClaw's Matrix integration npm package @openclaw/matrix versions = 2026.2.2 and 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matr...

CVE-2026-100540

Versions of OpenClaw Feishu prior to 2026.8.1 are vulnerable to an authentication bypass because the system fails to verify if a configured default account is disabled before using it for model tool operations. In multi-account configurations, an attacker can exploit a disabled default account th...

EUVD-2026-87510

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100540

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

EUVD-2026-87525

The OpenClaw Prometheus diagnostics plugin @openclaw/diagnostics-prometheus before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective...

PT-2026-99177

Name of the Vulnerable Software and Affected Versions OpenClaw Feishu versions prior to 2026.8.1 Description The software fails to validate if a configured default account is disabled before selecting it for model tool operations. In multi-account configurations, this allows attackers to use a...

PT-2026-99215

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description The software incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments, which are authentication modes that honor caller identity and narrower operator...

CVE-2026-100579: Authorization Bypass Through User-Controlled Key

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

PT-2026-99178

Name of the Vulnerable Software and Affected Versions @openclaw/matrix versions 2026.2.2 through 2026.8.0 Description The Matrix integration lowercases complete Matrix user IDs, including historical localparts and the case-sensitive server-name portion, when deriving the authorization identity...

CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

CVE-2026-84458

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...