Dikai Zou

**Name of the Vulnerable Software and Affected Versions** wolfSSL (affected versions not specified) **Description** Partial-chain certificate verification may accept chains that terminate at a peer-supplied, untrusted intermediate certificate instead of a trusted anchor. This allows an attacker to present a chain ending at an intermediate certificate they control and have it accepted as valid. This issue occurs in the OpenSSL compatibility certificate-path-building path using the `wolfSSL X509 verify cert()` function and `X509 STORE` when the `X509 V FLAG PARTIAL CHAIN` verify flag is enabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, avoid enabling the `X509 V FLAG PARTIAL CHAIN` verify flag.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A heap buffer overread occurs in the `wc PKCS7 DecodeEnvelopedData()` function when parsing specially crafted PKCS7 EnvelopedData. This issue could be triggered by attacker-supplied data delivered via S/MIME (Secure/Multipurpose Internet Mail Extensions) or CMS (Cryptographic Message Syntax). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An integer underflow occurs in the `wc PKCS7 DecryptOri()` function when processing specially crafted Other Recipient Info. This leads to incorrect length handling during the decryption process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An issue exists where SNI (Server Name Indication) and ALPN (Application-Layer Protocol Negotiation) bindings are missing during stateful session-ID resumption. This allows a cached session to be resumed using a different SNI or ALPN than what was originally negotiated. In environments where client-authentication policies vary across virtual hosts, this could allow a cached peer-authentication state to be applied to a context for which it was not intended. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.29 **Description** A Server-Side Request Forgery (SSRF) policy bypass exists in the browser debug and export routes. This issue allows the reuse of already-open blocked tabs, enabling attackers with access to these routes to bypass private-network SSRF policies. Consequently, they can export or inspect content that is intended to remain protected. **Recommendations** Update to version 2026.4.29.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.4 **Description** An authorization bypass exists in the bundled device-pair plugin. This issue allows non-owner authorized chat senders to issue device-pairing bootstrap codes because the system fails to perform proper scope validation. Attackers with chat command access can generate setup codes to enroll devices with operator or node capabilities, which provides them with persistent credentials until the devices are manually removed. **Recommendations** Update to version 2026.5.4 or later.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.18 **Description** A scope bypass exists in the Gateway 'chat.send' endpoint. This issue allows clients with the `operator.write` scope to execute privileged commands by utilizing inherited external routes. This bypass circumvents the requirements for `operator.approvals` and `operator.admin` scopes, enabling unauthorized mutations of plugins, configurations, MCP, allowlists, and ACP. **Recommendations** Update to version 2026.5.18 or later.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.12 **Description** A privilege escalation issue exists in Slack plugin approvals. This allows users with exec-authorized permissions to resolve plugin approvals via the exec approver gate, enabling them to bypass intended approval splits and approve plugin actions that fall outside the operator configuration. **Recommendations** Update to version 2026.5.12.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.29 **Description** A policy bypass exists in QQBot admin commands. This issue allows authenticated senders to circumvent `DM-only` and `allowFrom` policy checks. Consequently, attackers can route admin commands from unauthorized senders or contexts to execute restricted behaviors that the policy was intended to block. **Recommendations** Update to version 2026.4.29.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.18 **Description** An authorization bypass exists in the QQBot native approval buttons. The button callback path fails to enforce the configured approver identity, allowing users who are not authorized approvers to click approval buttons and resolve pending exec or plugin approval requests. This issue is specific to native QQBot approval buttons and does not affect the text command approval path. This occurs in deployments where native approval buttons are enabled and visible to unauthorized QQ users. **Recommendations** Update to version 2026.5.18 or later. Avoid delivering native approval buttons into QQ conversations that include users who should not be able to approve.