Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-53810

  CVE-2026-53810: openclaw Marketplace Runtime Extension Metadata Code Injection

  A crafted marketplace plugin package can point OpenClaw's runtime extension loader at hidden, unscanned code files, letting an installed plugin run arbitrary logic that was never reviewed during…

• high

  CVE-2026-53832: openclaw Trusted-Proxy Identity Header Forgery via Same-Host Loopback

  When OpenClaw's trusted-proxy auth mode was active, any local process on the same host could send a forged identity header directly to the Gateway port and authenticate as an arbitrary operator…

• highCVE-2026-53817

  CVE-2026-53817: openclaw Control UI Locality Spoofing to Admin Token Mint

  A flaw in how OpenClaw validated the network locality of Control UI pairing requests let an attacker with existing network access forge a loopback identity signal, skip manual approval, and walk…

• highCVE-2026-53814

  CVE-2026-53814: openclaw Hook-Triggered CLI Privilege Escalation to Owner MCP Scope

  Anyone holding an openclaw hook token can trigger an agent run that silently receives full owner-level MCP tool authority, letting an outsider call tools that should only be available to the…

• high

  CVE-2026-35630: openclaw QQBot Native Approval Button Authorization Bypass

  Any QQ user who can see an OpenClaw approval message could tap the native Allow button and authorize a pending exec or plugin action, even if they were not configured as an approver.

• high

  CVE-2026-53831: openclaw system.run Safe-Bin Allowlist Bypass via Shell Expansion

  OpenClaw's safe-bin allowlist for system.run checked command arguments before the shell expanded them, so a glob or environment variable that looked harmless at check time could silently become a…

• highCVE-2026-53815

  CVE-2026-53815: openclaw Message Read Action Channel Allowlist Bypass

  A flaw in OpenClaw's message read action lets a lower-trust caller fetch messages from channels they are not supposed to access, bypassing the operator-configured channel allowlist.

• high

  CVE-2026-53829: openclaw Exec Approval Display Truncation

  Authenticated users could submit an exec command long enough that the approval UI showed only a harmless-looking prefix, hiding a malicious suffix that would still run after the approver clicked…

• criticalCVE-2026-50027

  CVE-2026-50027: mcp-memory-service Missing Authentication on Document API Endpoints

  All seven file/document endpoints in mcp-memory-service accepted requests without any credentials, letting anyone on the network read, write, or delete stored AI memories even when API-key or OAuth…

• highCVE-2026-50163

  CVE-2026-50163: oras-go Hardlink Path Traversal via CWD Resolution

  A crafted OCI artifact with a tar hardlink entry pointing to a relative path can trick oras-go into linking files outside the extraction directory, exposing arbitrary files in the caller's working…

• highCVE-2026-53712

  CVE-2026-53712: scram-client SCRAM Channel-Binding Silent Authentication Downgrade

  A flaw in the OnGres SCRAM Java library lets a TLS man-in-the-middle silently strip channel binding from a SCRAM-SHA-256-PLUS login, defeating the only protection that channelBinding=require is…

• highCVE-2026-50138

  CVE-2026-50138: goshs WebDAV Mode-Flag Access Control Bypass

  When goshs is started with WebDAV enabled, the --read-only, --upload-only, and --no-delete restriction flags are silently ignored on the WebDAV port, letting any authenticated client write, delete…