Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-55786

  CVE-2026-55786: flyto-core Unauthenticated OS Command Injection via HTTP MCP

  flyto-core's HTTP MCP endpoint accepts JSON-RPC requests with no authentication check, letting any local process run arbitrary shell commands by calling the built-in sandbox.execute_shell module.

• highCVE-2026-35338

  CVE-2026-35338: uu_chmod --preserve-root Bypass via Unresolved Path

  The Rust rewrite of chmod trusts the raw argument string rather than the resolved filesystem path, so passing '/../' instead of '/' silently bypasses the --preserve-root guard and lets a recursive…

• criticalCVE-2026-49445

  CVE-2026-49445: Cilium Envoy Admin Socket World-Accessible Permission Misconfiguration

  When Cilium L7 policies are active, the Envoy admin Unix socket is created with world-accessible permissions, letting any local user on the node read TLS secrets, drain connections, or kill the…

• highCVE-2022-46292

  CVE-2022-46292: Open Babel MOPAC Output Parser Out-of-Bounds Write (UNIT CELL TRANSLATION)

  Opening a crafted MOPAC output file with Open Babel causes the parser to write past the end of a fixed-size stack array, which can corrupt the stack and lead to arbitrary code execution.

• high

  CVE-2026-53833: OpenClaw QQBot Incorrect Authorization on /bot-streaming Command

  Any QQBot sender could invoke the /bot-streaming admin command and change OpenClaw streaming configuration, even without being on an explicit trusted-sender allowlist.

• high

  CVE-2026-53823: OpenClaw Slack allowFrom Authentication Bypass via Mutable Display Names

  OpenClaw's Slack allowlist matched on mutable display names instead of stable user IDs, letting any workspace member rename themselves to impersonate an allowlisted identity and gain agent access.

• high

  CVE-2026-53821: openclaw Trusted-Proxy WebSocket Scope Elevation

  A restricted or unpaired OpenClaw user on a trusted-proxy deployment could declare admin-level permissions on a WebSocket connection before the server ever verified those permissions, then use that…

• high

  CVE-2026-53822: OpenClaw Shell Wrapper Argv TOCTOU Allowlist Bypass

  OpenClaw's shell wrapper approval flow could be tricked into checking one command at approval time and running a completely different command at execution time, letting an attacker bypass the…

• highCVE-2026-53810

  CVE-2026-53810: openclaw Marketplace Runtime Extension Metadata Code Injection

  A crafted marketplace plugin package can point OpenClaw's runtime extension loader at hidden, unscanned code files, letting an installed plugin run arbitrary logic that was never reviewed during…

• high

  CVE-2026-53832: openclaw Trusted-Proxy Identity Header Forgery via Same-Host Loopback

  When OpenClaw's trusted-proxy auth mode was active, any local process on the same host could send a forged identity header directly to the Gateway port and authenticate as an arbitrary operator…

• highCVE-2026-53817

  CVE-2026-53817: openclaw Control UI Locality Spoofing to Admin Token Mint

  A flaw in how OpenClaw validated the network locality of Control UI pairing requests let an attacker with existing network access forge a loopback identity signal, skip manual approval, and walk…

• highCVE-2026-53814

  CVE-2026-53814: openclaw Hook-Triggered CLI Privilege Escalation to Owner MCP Scope

  Anyone holding an openclaw hook token can trigger an agent run that silently receives full owner-level MCP tool authority, letting an outsider call tools that should only be available to the…