Security advisories

low2026-04-02

CVE-2026-41376-OpenClaw: Matrix thread root and reply context bypass sender allowlist

openclaw/openclaw · GHSA-rg8m-3943-vm6q

high2026-04-02

CVE-2026-41336-OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

openclaw/openclaw · GHSA-3qpv-xf3v-mm45

medium2026-04-02

CVE-2026-41406-OpenClaw: Feishu thread history and quoted messages bypass sender allowlist

openclaw/openclaw · GHSA-877v-w3f5-3pcq

critical2026-04-02

CVE-2026-41329-OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

openclaw/openclaw · GHSA-g5cg-8x5w-7jpm

low2026-04-02

CVE-2026-41402-OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass

openclaw/openclaw · GHSA-hhq4-97c2-p447

medium2026-04-02

CVE-2026-41385-OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get

openclaw/openclaw · GHSA-jjw7-3vjf-fg5j

high2026-04-02

CVE-2026-41391-OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

openclaw/openclaw · GHSA-7ggg-pvrf-458v

medium2026-04-02

CVE-2026-41337-OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection

openclaw/openclaw · GHSA-89r3-6x4j-v7wf

medium2026-04-02

CVE-2026-41394-OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

openclaw/openclaw · GHSA-mhgq-xpfq-6r66

critical2026-04-02

CVE-2026-34976-Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

dgraph-io/dgraph · GHSA-p5rh-vmhp-gvcw

critical2026-04-02

CVE-2026-34950-fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key

nearform/fast-jwt · GHSA-mvf2-f6gm-w987

medium2026-04-02

CVE-2026-34835-Rack::Request accepts invalid Host characters, enabling host allowlist bypass

rack/rack · GHSA-g2pf-xv49-m2h5

medium2026-04-02

CVE-2026-34831-Rack has Content-Length mismatch in Rack::Files error responses

rack/rack · GHSA-q2ww-5357-x388

medium2026-04-02

CVE-2026-34830-Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

rack/rack · GHSA-qv7j-4883-hwh7

high2026-04-02

CVE-2026-34829-Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

rack/rack · GHSA-8vqr-qjwx-82mw

medium2026-04-02

CVE-2026-34763-Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

rack/rack · GHSA-7mqq-6cf9-v2qp

high2026-04-02

CVE-2026-34230-Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

rack/rack · GHSA-v569-hp3g-36wr

medium2026-04-02

CVE-2026-32762-Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

rack/rack · GHSA-qfgr-crr9-7r49

medium2026-04-02

CVE-2026-26962-Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values

rack/rack · GHSA-rx22-g9mx-qrhv

medium2026-04-02

CVE-2026-26961-Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.

rack/rack · GHSA-vgpv-f759-9wx3