Top impactful security developments (2026-09-26 06:48) - 1 day summary

High‑impact security incidents (CVSS ≥ 7) reported between the start of the query window and 26 Sept 2026

# CVE / EUVD ID CVSS Score Affected component Vulnerable versions Brief technical impact Primary references
1 CVE‑2026‑100595 (EUVD‑2026‑87456) 7.1 (High) OpenClaw – npm‑distributed agent runtime (JavaScript/Node.js) < 2026.7.1 (all releases before 2026.7.1) Authorization‑bypass in the diagnostics‑export command. A non‑owner channel sender can request and receive owner‑only host diagnostic bundles (runtime config, connected services, system info). This leaks privileged host information and can be chained to further privilege‑escalation. • EUVD detail: https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87456
• GitHub advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-4hwv-rj92-h7rp
2 CVE‑2026‑100594 (EUVD‑2026‑87457) 7.1 (High) OpenClaw – same npm package < 2026.7.1 Authorization‑bypass in the /export‑trajectory endpoint. A non‑owner sender can obtain owner‑only trajectory bundles, exposing prompts, model messages, tool schemas, runtime events and local‑path metadata. • EUVD detail: https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87457
• GitHub advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-89cw-7452-cfrf
3 EUVD‑2026‑87462 8.7 (Critical) OpenClaw – sandbox component (browser‑tool) < 2026.7.1 Sandbox‑bypass: despite allowHostControl=false, a sandboxed session can invoke paired‑node browser actions, giving the attacker control over the host browser environment. https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87462
4 EUVD‑2026‑87464 7.1 (High) OpenClaw – diagnostics export (same issue as CVE‑2026‑100595) < 2026.7.1 Re‑published description of the diagnostics‑export auth‑bypass. https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87464
5 EUVD‑2026‑87456 (duplicate of #1) 7.1 (High) OpenClaw – diagnostics export < 2026.7.1 Same as CVE‑2026‑100595. https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87456
6 EUVD‑2026‑87457 (duplicate of #2) 7.1 (High) OpenClaw – export‑trajectory < 2026.7.1 Same as CVE‑2026‑100594. https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87457
7 EUVD‑2026‑87468 5.4 (Medium) – not in priority‑1/2 but listed for completeness OpenClaw – PowerShell command analysis (Windows exec allow‑list) >= 2026.2.26 && < 2026.7.1 Allows an exact executable resolved from PATH to be approved, but a different same‑named executable can be executed later, leading to command‑injection style abuse. https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87468
8 EUVD‑2026‑87461 5.3 (Medium) – not in priority‑1/2 OpenClaw – /voice set command < 2026.7.1 Authorization‑bypass that lets non‑owner senders persist gateway‑voice configuration. https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87461
9 EUVD‑2026‑87456 (duplicate) 7.1 (High) OpenClaw – diagnostics export (same as #1) < 2026.7.1 – –
10 EUVD‑2026‑87456 (duplicate) 7.1 (High) OpenClaw – diagnostics export (same as #1) < 2026.7.1 – –

Why these are the most impactful for the requested period

  • Priority 1 focus – All listed items are authorization‑bypass or sandbox‑bypass flaws in a widely‑used npm library (OpenClaw) that runs with high privileges on the host.
  • CVSS ≥ 7 – Scores range from 7.1 (High) to 8.7 (Critical), satisfying the “critical or high” threshold.
  • Authentication / encryption relevance – The vulnerabilities allow unauthenticated or non‑owner actors to obtain privileged data or execute privileged actions, effectively breaking the authentication model of the OpenClaw agent.
  • Supply‑chain impact – OpenClaw is distributed via npm, meaning any project that pulls the package (including CI pipelines, container images, or server‑side agents) is potentially exposed – a classic open‑source supply‑chain risk (Priority 2).
  • No higher‑scoring kernel, browser, container‑orchestrator, or OS flaws were present in the supplied data set for the period, so the OpenClaw issues dominate the high‑severity landscape.

Mitigation / remediation guidance (derived from the source advisories)

Vulnerability Recommended action
CVE‑2026‑100595 / EUVD‑2026‑87456 (diagnostics export) Upgrade OpenClaw to ≥ 2026.7.1 (the first release that fixes the auth‑bypass). If immediate upgrade is not possible, block the diagnostics/export RPC endpoint at the network/firewall level and restrict channel access to trusted owners only.
CVE‑2026‑100594 / EUVD‑2026‑87457 (export‑trajectory) Same upgrade path (≥ 2026.7.1). Apply additional RBAC controls on the /export‑trajectory API if the package is used in a multi‑tenant environment.
EUVD‑2026‑87462 (sandbox bypass) Upgrade to ≥ 2026.7.1. Review sandbox configuration (allowHostControl) and enforce strict host‑control policies.
EUVD‑2026‑87468 (PowerShell allow‑list) Upgrade to ≥ 2026.7.1 (or at least ≥ 2026.2.26). Audit PowerShell command allow‑list rules and ensure they are not overly permissive.
EUVD‑2026‑87461 (voice set) Upgrade to ≥ 2026.7.1. Restrict voice‑configuration commands to owner‑only channels.

Source URLs (all publicly accessible)

Bottom line:
During the reporting window, the OpenClaw npm package generated the most critical security incidents, with multiple high‑severity CVEs (7.1 – 8.7) that affect authentication/authorization mechanisms and can be exploited through supply‑chain exposure. Immediate upgrading to version 2026.7.1 (or later) eliminates all of the listed flaws. No other CVSS ≥ 7 vulnerabilities in OS kernels, browsers, container orchestrators, or core cryptographic libraries were observed in the provided data.

Model=gpt-oss:120b top_k=70 context_window=131072 query_mode=cluster