EUVD-2026-87146

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

CVE-2026-67234

The messaging broker RabbitMQ is vulnerable in versions 4.2.0 through 4.2.8 and 4.3.2 due to a flaw in the get_auth_mechanism/1 function. When clearing the strict_auth_mechanism or preferred_auth_mechanism atom, the software used term_to_binary/1, resulting in a non-ASCII cookie name that violate...

CVE-2026-82053: Incorrect Authorization

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the...

GHSA-4M82-P8CX-F94J SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls

A LIVE SELECT subscription records the user's auth state $auth, $token, $session, $access when it is registered, and the server uses that recorded state to evaluate the table- and row-level PERMISSIONS clauses for every subsequent notification. The recorded state is never refreshed. When somethin...

GHSA-F76X-F9VJ-92JV NocoDB: Stale Auth Cache After API Token Deletion

Summary Deleted API tokens continued to authenticate requests until their cache entry expired, because the auth cache was not invalidated by token value at deletion time. Details The API token deletion path removed the database row but did not evict the token-value keyed entry from the auth cache...

CVE-2026-41916 OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload

OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through...

EUVD-2026-26122

OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through...

Insufficient Session Expiration

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Session Expiration due to the resolvedAuth process becoming outdated after a configuration reload. An attacker can maintain unauthorized access by leveraging stale...