CVE-2026-100608 Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud, the /admin/queues mount is protected only by the...

CVE-2026-100607 Flowise through 3.1.4 Authentication Bypass via Email-Only SSO

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including...

CVE-2026-100605 Flowise through 3.1.4 Missing Authorization via Chat Message Routes

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read cha...

CVE-2026-100606 Flowise through 3.1.4 Authentication Bypass via SSO Email Match

Flowise through 3.1.4 Enterprise/platform mode with SSO enabled contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin SSOBase.ts:80-94 copies the user record from the database — including the...

CVE-2026-100604 ClawHub Authentication Bypass via Former Publisher Skill Control

ClawHub openclaw/clawhub contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current...

CVE-2026-100603 ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports

ClawHub openclaw/clawhub application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can report a visible skill and trigger automatic hiding moderationStatus: hidden of that skill from the catalog without any moderator decision. Because t...

CVE-2026-100602 ClawHub Changelog Preview Information Disclosure via Authorization Bypass

ClawHub openclaw/clawhub application/backend contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read...

CVE-2026-100601 ClawHub SSRF via Unchecked DNS Resolution in Profile Image

ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...

CVE-2026-100600 ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API

ClawHub the openclaw/clawhub application/backend does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous API requests share a single default quota allowance. A remote, unauthenticated caller can drain that shared allowance and thereby deny or degrade API...

CVE-2026-100312 mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possib...

CVE-2026-98163 cgroup: Avoid iteration of dying tasks with zero refcount

In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea "cgroup: Move dyingtasks cleanup from cgrouptaskrelease to cgrouptaskfree" extended the lifetime of tasks on the dyingtasks list. The iterators ha...

CVE-2026-100598 OpenClaw before 2026.7.1 Approval Binding Logic Error

OpenClaw npm package openclaw before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to resolve a structured approval request could instead attach to ordinary outbound text when unrelated outbound messages and a pending approval are present in the...

CVE-2026-100599 OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...

CVE-2026-100597 OpenClaw before 2026.7.1 Path Traversal via Filesystem Race

OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...

CVE-2026-100595 OpenClaw before 2026.7.1 Authorization Bypass via diagnostics

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive diagnostic details about the host, configuration, runtime, and...

CVE-2026-100596 OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration

OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host...

CVE-2026-100594 OpenClaw before 2026.7.1 Authorization Bypass via trajectory export

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadat...

CVE-2026-100592 OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming

OpenClaw is an agent gateway distributed via npm. In versions = 2026.4.10 and 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable...

CVE-2026-100593 OpenClaw before 2026.7.1 Authentication Bypass via activation

OpenClaw npm package openclaw before 2026.7.1 does not enforce the documented owner-only requirement for persistent /activation policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond mor...

CVE-2026-100591 OpenClaw before 2026.7.1 Authentication Bypass via Active Memory

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...

CVE-2026-100589 OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node

OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over sandboxed agent input can select a paired node and perform ho...

CVE-2026-100590 OpenClaw before 2026.7.1 Authorization Bypass via voice set

OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel senders to persist Gateway voice configuration. Attackers with command access can change the voice used by Talk responses for the configured provider, affecting...

CVE-2026-100588 OpenClaw before 2026.7.1 Authentication Bypass via node.invoke

OpenClaw npm package 'openclaw' before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke method, although direct browser.request access requires administrator scope. In Gateway deployments that honor caller identity and...

CVE-2026-100586 OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind

OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native conversation bindings. Non-owner channel senders with command access can create bindings to the native Codex runtime and execute host-capable turns with access to files, tools, and processes...

CVE-2026-100587 OpenClaw before 2026.7.1 Authorization Bypass via Codex Install

OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and...

CVE-2026-100585 OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel

OpenClaw npm package openclaw before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request...

CVE-2026-100584 OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows

OpenClaw is an npm-distributed agent runtime. In versions = 2026.2.26 and 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named executable located in the workspace directory...

CVE-2026-100583 OpenClaw Discord before 2026.7.1 Authorization Bypass

OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-target policy to access guild metadata fr...

CVE-2026-100582 OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass

OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...

CVE-2026-100580 OpenClaw before 2026.7.1 Remote Code Execution via cron tool

OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...

CVE-2026-100579 OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

CVE-2026-100578 OpenClaw before 2026.7.1 Authorization Bypass via chat.send

OpenClaw npm package openclaw before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn...

CVE-2026-100577 OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

CVE-2026-100576 OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates

OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or...

CVE-2026-100574 OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS

OpenClaw npm package 'openclaw' before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address 0.0.0.0 or :: bypasses the SSRF destination validation...

CVE-2026-100575 OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM

OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies...

CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

OpenClaw npm package 'openclaw' versions = 2026.6.6 and 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunn...

CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit

OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...

CVE-2026-100570 OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when...

CVE-2026-100569 OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override

OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...

CVE-2026-100568 OpenClaw before 2026.8.1 Unauthorized Command Job Access

OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secret...

CVE-2026-100567 OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname

OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions = 2026.4.5 and 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol CDP hostname, but the raw WebSocket and Playwright transports performed a later,...

CVE-2026-100566 OpenClaw LINE before 2026.8.1 Access Control Inheritance

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restriction...

CVE-2026-100564 OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export

OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV exports. Attackers can inject formula-like cells that execute with spreadsheet user permissions when the export is opened in formula-enabled applications...

CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels

OpenClaw npm package openclaw before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas when the Control UI exports session data to CSV. Although session labels were quoted as CSV text, a lower-trust participant who can influence a session label or...

CVE-2026-100562 OpenClaw before 2026.8.1 Authorization Bypass via sessions.create

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provide...

CVE-2026-100560 OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval...

CVE-2026-100561 OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper

OpenClaw npm package 'openclaw' versions = 2026.3.22 and 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign...

CVE-2026-100559 OpenClaw before 2026.8.1 Command Injection via Escaped Newlines

OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected...