Feed Trends Digest

Am I affected?CVSS calculator

API docs MCP server OpenAPI llms.txt RSS

VulnSea · CVE intelligence for humans and agents · data from NVD, CVE.org, GitHub Advisory Database, FIRST EPSS, CISA KEV and others — full attribution. This product uses the NVD API but is not endorsed or certified by the NVD.

For agents:llms.txt OpenAPI digest RSS

About Trends Digest Status Blog Privacy Terms Sponsor

Informational only. Verify against the official advisory before acting.

© 2026 VulnSea. All rights reserved.

← Back to feed

Depth

6.5Sunlit

GHSA-6jm4-83g2-35gvMedium· 6.5▾ Sunlit

Duplicate Advisory: memory-wiki shared search could miss session visibility checks

Duplicate Advisory: memory-wiki shared search could miss session visibility checks

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 16, 2026

Updated

Jun 18, 2026

CVSS

6.5

Vendor

openclaw

Product

openclaw

CWE

CWE-862

Depth score

36 · Low

EPSS

—

Platforms

—

Source

GHSA

Vector

—

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 2 days

Jun 16, 2026Published
Disclosed via GHSA
Jun 18, 2026Record revised
Last analysed / modified upstream

openclaw CWE-862 #ghsa #npm

Affected

openclaw < 2026.4.29

Full technical detail▾

Overview

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-72fw-cqh5-f324. This link is maintained to preserve external references.

Original DescriptionOpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guards on the search path to retrieve memory entries that should not be visible to their session.

Affected packages

openclaw < 2026.4.29

Remediation

Refer to the advisory for the patched release.

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-72fw-cqh5-f324
https://nvd.nist.gov/vuln/detail/CVE-2026-53844
https://www.vulncheck.com/advisories/openclaw-session-visibility-check-bypass-in-shared-memory-search
https://github.com/advisories/GHSA-6jm4-83g2-35gv

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

GHSA-qjpc-qf9m-xwmrHigh· 8.8
OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
same productCWE-862
GHSA-hcm3-8f6r-6xwgMedium· 6.5
OpenClaw: Browser debug/export routes could reuse already-open blocked tabs
same productCWE-862
GHSA-3wqp-prf6-2m72Low· 3.1
OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement
same productCWE-862
GHSA-mgq6-vr84-7m2jHigh· 8.0
OpenClaw: QQBot native approval buttons did not enforce configured approver identity
same productCWE-862
GHSA-hw9r-h9mr-4jffHigh· 8.8
OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
same productCWE-862
GHSA-gw2c-6hcg-5g52Medium· 5.5
Duplicate Advisory: Focus command could miss controlScope enforcement
same productCWE-862

#ghsa#npm