Security advisories

high2026-03-13

CVE-2026-32974-OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured

openclaw/openclaw · GHSA-g353-mgv3-8pcj

high2026-03-13

OpenClaw: Gateway `agent` calls could override the workspace boundary

openclaw/openclaw · GHSA-2rqg-gjgv-84jm

critical2026-03-13

CVE-2026-22172-OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

openclaw/openclaw · GHSA-rqpp-rjj8-7wv8

high2026-03-13

CVE-2026-32918-`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

openclaw/openclaw · GHSA-wcxr-59v9-rxr8

high2026-03-13

CVE-2026-32920-OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories

openclaw/openclaw · GHSA-99qw-6mr3-36qr

high2026-03-13

OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces

openclaw/openclaw · GHSA-r7vr-gr74-94p8

medium2026-03-13

OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths

openclaw/openclaw · GHSA-f8r2-vg7x-gh8m

medium2026-03-13

OpenClaw: Feishu reaction events could bypass group authorization and mention gating

openclaw/openclaw · GHSA-m69h-jm2f-2pv8

high2026-03-13

OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes

openclaw/openclaw · GHSA-vmhq-cqm9-6p7q

medium2026-03-13

OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens

openclaw/openclaw · GHSA-7h7g-x2px-94hj

medium2026-03-13

OpenClaw's Zalouser allowlist authorization matched mutable group names by default

openclaw/openclaw · GHSA-f5mf-3r52-r83w

critical2026-03-13

CVE-2026-32621-Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

apollographql/federation · GHSA-pfjj-6f4p-rvmh

medium2026-03-13

CVE-2026-32612-Statamic vulnerable to privilege escalation via stored cross-site scripting

statamic/cms · GHSA-hcch-w73c-jp4m

high2026-03-13

idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability

blowdart/idunno.bluesky · GHSA-8fh9-c4jq-94h4

low2026-03-13

Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning

centrifugal/centrifugo · GHSA-q926-c743-49qj

high2026-03-13

CVE-2026-32600-simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

simplesamlphp/xml-security · GHSA-r353-4845-pr5p

high2026-03-13

CVE-2026-1526-Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

nodejs/undici · GHSA-vrm6-8vpv-qv8q

high2026-03-13

CVE-2026-2229-Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

nodejs/undici · GHSA-v9p9-hfj2-hcw8

medium2026-03-13

CVE-2026-1527-Undici has CRLF Injection in undici via `upgrade` option

nodejs/undici · GHSA-4992-7rv2-5pvq

medium2026-03-13

CVE-2026-2581-Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS

nodejs/undici · GHSA-phc3-fgpg-7m6h