Privilege escalation in Elastic Kibana's Agent Builder feature lets an authenticated non-administrative user who can edit a shared agent cause privileged operations to run under the identity of a higher-privileged user who later interacts with that agent (CWE-441 confused deputy). Rated CVSS 7.3 High (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), the flaw requires the Agent Builder feature to be enabled with at least one shared agent, the attacker to hold edit privileges on it, and a privileged victim to interact with the tampered agent; if the attacker can also author workflows, escalation to full Kibana and Elasticsearch cluster administrative control is possible. No public exploit identified at time of analysis, and vendor patches are available in Kibana 9.4.7 and 9.5.0.
Decompiling a maliciously crafted binary with Ghidra through 12.1.4 can drive a stack-based out-of-bounds write inside the decompiler's leftshift128 routine, letting the sample corrupt process memory and potentially achieve code execution in the analyst's Ghidra session. The flaw is triggered when a specific instruction sequence lowers to p-code containing a negative shift amount that reaches the RuleDivOpt/RuleDivTermAdd divisor-optimization path; no privileges are required (PR:N in both the reported CVSS 4.0 vector and the independent CVSS 3.1 assessment), but exploitation is gated on the victim loading and decompiling the attacker-supplied file (UI:P/UI:R), making this a targeted threat against reverse engineers rather than a remote one. At the time of analysis, no public exploit code has been identified for this issue and there is no confirmed active exploitation (CISA KEV status is not present).
Capgo's Supabase backend bundle-promotion API allows an authenticated API key holder with app-level channel.promote_bundle to bypass explicit per-channel deny overrides and promote a bundle to a channel they were denied, updating public.channels.version. This affects Capgo (Cap-go/capgo.app) deployments, confirmed on main at commit de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 and likely earlier versions; no vendor-released patch was known at publication. The flaw only has impact when an administrator has configured a per-channel allow or deny override on the target channel_id, and no public exploit identified at time of analysis; the vendor/VulnCheck CVSS 4.0 base score is 7.2.
Authenticated non-owner senders can abuse the generic channel-tool path in the @openclaw/whatsapp plugin (npm, versions before 2026.8.1) to force a WhatsApp login for a configured Gateway account, issuing a fresh QR code that disconnects the existing session and causes loss of availability; integrity impact is limited because full account relinking still requires the attacker to physically scan the returned QR code with another phone. The flaw is a missing authorization check on an owner-only tool boundary (CWE-862) rather than a bypass of WhatsApp transport authentication, and it requires PR:L - an attacker who has already been admitted to a channel and can steer the agent. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 2026.8.1.
Authorization bypass in OpenClaw before 2026.7.1 allows a write-scoped caller in identity-bearing Gateway deployments to spoof another sender's identifier in message.action requests and invoke a channel action under that requester identity, reaching operations the channel adapter would have denied to the real caller. Exploitation requires a valid low-privilege (write-scoped) credential, an authentication mode that honors caller identity (shared-secret token and password callers are explicitly out of scope), and at least one enabled channel action that relies on requester identity; practical impact is bounded by the enabled channel, the action invoked, and the target account's permissions. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the vendor-released fix is version 2026.7.1.
OpenClaw Gateway before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint, allowing an authenticated write-scoped non-owner caller to cause the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. This privilege escalation (CWE-269) affects Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, and where agent tool policies include the `gateway` and `cron` tools; shared-secret token and password callers are treated as fully trusted and are out of scope. No public exploit code identified at time of analysis; the vendor CVSS 4.0 score is 7.2 with integrity impact dominant.
Pre-inference resource exhaustion in vLLM up to and including 0.29.0 lets remote attackers force the API server or batch runner to fully download, base64-decode and materialize attacker-controlled media before the documented VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio cap (25 MB default) and the per-modality --limit-mm-per-prompt item limits are enforced. Four ingress paths are affected - the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/base64 path, the batch speech runner, and the Rust frontend POST /tokenize route - with the /tokenize path unauthenticated by design and the chat/batch surfaces gated only when an API key is actually configured, so an attacker can allocate memory and consume outbound bandwidth proportional to an attacker-chosen body size or media-item count. Impact is availability-only (no code execution or data disclosure); the vendor CVSS 4.0 vector scores 7.1 with PR:L, while the independent assessment scores it 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) to reflect the unauthenticated /tokenize path, and no public exploit code was identified at time of analysis.
Cross-site request forgery in SiYuan lets an attacker-controlled web page reach the locally bound kernel and, through the CheckAuth lock-screen pass-through branch that skips Origin validation, perform administrator-level operations with zero credentials. Successful abuse allows the attacker to terminate the kernel process (availability impact assessed as High), read workspace configuration and proxy settings, and trigger administrative actions, with exploitation requiring the victim to have the SiYuan kernel running (default loopback binding) and to open a malicious page in a browser on the same host. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in v3.8.4.
Sensitive local file disclosure in OpenClaw before 2026.8.1 lets a low-privileged caller (PR:L per the CVSS vector, not fully anonymous) smuggle an unvalidated absolute host path past sandbox path validation by supplying structured message attachments that carry multiple 'source' fields, hiding the disallowed path behind an allowed attachment source. When the Telegram delivery channel is configured and active, the agent then reads the referenced host file and relays it out through that channel, giving the attacker high-confidentiality read access to files that policy would otherwise reject. There is no code execution, file modification, or denial of service; EPSS and KEV data are not provided, and no public exploit code has been identified at time of analysis. The vendor has released a fix, and exploitation requires both a message-submission-capable attacker and an OpenClaw deployment that uses Telegram delivery.
An authenticated attacker with low privileges can exploit an authorization bypass in the @openclaw/slack npm package (versions before 2026.8.1) to download file contents from Slack conversations outside their permitted scope, resulting in cross-boundary data disclosure. The flaw is an IDOR-class (CWE-639) issue where the conversation-authorization check fails open when a file lacks the share metadata normally used to prove conversation membership. No public exploit code or active exploitation has been identified, and the issue does not bypass Slack's own authentication or allow file enumeration. Vendor patch 2026.8.1 is available.
MFA bypass in StoatChat before 0.15.5 allows an authenticated attacker to satisfy the MFA step-up re-authentication challenge for another user's session by presenting an MFA ticket minted from their own account, enabling them to disable the victim's TOTP, view recovery codes, and perform other sensitive account operations without knowing the victim's credentials. Exploitation is conditionally gated: the attacker must hold both a valid StoatChat account (to obtain a legitimate ticket) and an already-stolen victim session token, which the flaw itself does not provide. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 0.15.5 as the fix.
Authenticated members of a Stoat Chat deployment can permanently (until restart) disable push notifications and mention badges for the entire instance by sending five specially crafted role-mention messages. The messages are routed to the acknowledgement worker that handles mass mentions, and the resulting unhandled exception terminates every acknowledgement worker process-wide, so the failure is not confined to the sender's own session. The issue affects all stoatchat releases before 0.15.5; exploitation requires a valid account with the ability to post messages containing role mentions (PR:L), with no victim interaction needed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in 0.15.5.
Denial of service in vLLM before 0.29.0 allows an authenticated API user to permanently disrupt the inference service with a single malformed request to the OpenAI-compatible POST /v1/completions or POST /v1/chat/completions endpoints. The server accepts user-supplied stop_token_ids and checks only that they are integers, not that they fall within the model's vocabulary/logits range; when min_tokens > 0 those ids are used as logits indices to suppress stop tokens, so an out-of-range value reaches a CUDA index_put_ operation and trips a device-side assertion that returns HTTP 500 and leaves EngineCore in a fatal state until the service is restarted. The impact is bounded to availability (no code execution or data disclosure) and exploitation requires valid API credentials plus exposure of the OpenAI-compatible endpoints; no public exploit code was identified at time of analysis, and the vendor has released a fix.
Denial of service in vLLM deployments running versions before 0.29.0: an attacker with low-privilege access to the disaggregated serving endpoint /inference/v1/generate can submit an overlong token_ids list accompanied by a 'features' (multimodal) payload, bypassing prompt-length validation and causing a worker failure that takes down inference capacity. The issue is availability-only (no confidentiality or integrity impact) and is reachable over the network without user interaction, but exploitation requires that the deployment run in non-default disaggregated serving mode with a multimodal model whose processor reports skip_prompt_length_check=True (Nemotron Parse, Whisper, or FireRedLID), so standard single-node text-only vLLM installations are not exposed. Vendor-released patch: 0.29.0; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Missing authorization enforcement in ClawHub's public skills:generateChangelogPreview action lets any signed-in caller preview the prior version of a skill they are not authorized to access, disclosing up to 8,000 characters of quarantined or otherwise restricted skill content per request. The issue is rated 7.1 (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N; independent CVSS 3.1 assessment 7.1 with confidentiality impact only) and requires nothing more than a valid ClawHub account - no user interaction, special network position, or non-default configuration - while impact is limited to reading content, with no integrity or availability effect. No public exploit code has been identified at time of analysis; the hosted clawhub.ai service was remediated by the 2026-09-11 deployment of revision 8c2de6c506bb, so realistic residual exposure is confined to self-hosted deployments built from revisions at or after cbfee7343ddc867316dd9b3de6fa8856730f9f41 and before that fix.
Parse Server LiveQuery, the platform's real-time subscription component, can leak field values that the REST API properly withholds, affecting releases from 9.0.0 up to (but not including) 9.10.1-alpha.8 and all versions below 8.6.89. An authenticated subscriber (CVSS vectors for this issue specify PR:L, i.e. authenticated) can receive redacted-eligible field values and even use a masked field as a subscription filter, because LiveQuery evaluates the class-level protectedFields permission against an incompletely resolved caller identity: subscriber roles are never resolved, and when a subscription omits its own session token the payload is redacted against an anonymous identity even though the underlying read was authorized as the connected user. Only classes with LiveQuery enabled that define protectedFields under a role: group, the authenticated group, or a per-user group are exposed; masks defined under the public (*) group behave correctly, and only the specific masked fields are disclosed rather than arbitrary data, so this is a genuine but access-gated disclosure issue rather than an urgent one. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, and vendor-released patches (9.10.1-alpha.8 and 8.6.89) are available.
An authenticated user who can author raw Twig in page content on Grav CMS 2.0.0 through 2.0.24 can escape the Twig content sandbox and read the site's entire configuration tree, exposing plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs, and the security.* subtree that the sandbox's redaction is designed to hide. The escape works because the `array` filter and its function form are allowlisted in the sandbox without the needs_is_sandboxed guard carried by print_r, vardump, json_encode, yaml_encode and string, and its implementation calls toArray() or an (array) cast without consulting the sandbox method allowlist, so `grav|array` unwraps the raw Pimple dependency-injection container and its private $values. Because the payload is stored in page content, the disclosed configuration is rendered to unauthenticated visitors; exploitation requires the authoring privilege (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and no public exploit was identified at time of analysis. Grav 1.7 is not affected because it has no Twig content sandbox, and the issue is fixed in Grav 2.0.25.
Cross-tenant information disclosure in Budibase Server before 3.45.0 allows an authenticated low-privilege user to read another tenant's application metadata and source code by supplying a victim tenant's app ID to the GET /api/applications/:appId/appPackage endpoint, which omits an ownership check. Successful exploitation exposes navigation structure, role names, internal screen URLs, embedded JavaScript snippets, and user identifiers belonging to the victim application. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); real-world risk is concentrated in multi-tenant hosted or shared self-hosted deployments where untrusted tenants coexist, while single-tenant deployments sharply limit impact.
Local file disclosure in OpenClaw (npm package 'openclaw') before 2026.8.1 allows an authenticated, already-admitted requester to read arbitrary known local host files even when that sender's identity has been explicitly denied filesystem read tools through the global or per-agent toolsBySender policy. The bypass occurs because outbound attachment handling - via a final-response media directive or a message attachment - does not re-apply the originating sender's policy, so a denied sender can still have a known local file read and returned to an admitted requester whose agent turn never included the read tool. Exploitation requires the attacker to already be admitted to the agent, to know or derive a useful host path, and to reach a delivery flow that accepts local attachments; impact is read-only disclosure of file contents with no integrity or availability effect, and no public exploit code has been identified at time of analysis.
Information disclosure in OpenClaw before 2026.7.1 allows authenticated non-owner channel senders to retrieve owner-only host diagnostic bundles through the diagnostics export command, exposing host, configuration, runtime, and connected-service details. The flaw is an authorization bypass (CWE-200) that requires low privileges (a connected channel sender) and causes no integrity or availability impact; no public exploit code is identified at time of analysis.
An authorization bypass in the /export-trajectory endpoint of OpenClaw before 2026.7.1 lets a non-owner account retrieve trajectory bundles that should be restricted to the session owner. A remote attacker who holds any valid low-privilege credentials on the instance (PR:L, not anonymous) can request a session they do not own and receive its exported bundle, exposing prompts, model messages, tool schemas, runtime events, and local path metadata; the effect is disclosure only, with no integrity or availability impact (VC:H, VI:N, VA:N). No public exploit code has been identified at time of analysis, and the vulnerability is not listed as actively exploited, though the high EPSS-equivalent exposure of a network-reachable, low-complexity bypass makes prompt remediation to 2026.7.1 advisable.
Privilege escalation in the Capgo capgo.app backend (versions ≤ 12.261.0) lets an authenticated user who holds only the apikey_manager organization role mint API keys bound to higher-privileged deploy roles (app_developer, app_uploader, channel_developer, channel_uploader). Those keys can in turn be used to push arbitrary over-the-air JavaScript updates to every end user of the organization's apps, giving an insider or delegated-role holder unauthorized write access to production app content. Exploitation requires a valid JWT session and the apikey_manager role (authenticated, no user interaction), no public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; at advisory publication no patched version was available.
Channel read allowlist bypass in the OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 lets a low-privilege sender or a steered/prompt-injected agent pull messages, reactions, pins, member lists, and related metadata out of channels and rooms that the operator's read policy was intended to exclude. Exploitation is unauthenticated at the network layer but requires an existing low-privilege channel read capability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and it only matters where a restrictive read allowlist is actually configured - default open policies expose nothing new. Exposure is further bounded by the permissions held by the connected bot account, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor fixed the issue in 2026.8.1.
Server-side request forgery in OpenClaw Gateway (npm-distributed, versions 2026.7.1 through 2026.8.0) lets an authenticated, write-scoped caller abuse Synology Chat attachment delivery: the Gateway validates a single DNS lookup for a supplied file URL but then hands the original hostname to the Synology NAS, which resolves it independently and can be steered to a private or policy-denied resource whose contents are returned to the addressed conversation. Reaching that outcome requires remote URL attachment forwarding to be enabled, the Gateway to accept a remotely-influenced hostname, and the attacker to win a DNS rebinding race against the NAS's own resolution, so practical impact hinges on NAS routing, resolver behavior, and whether a useful response exists at the private destination; no public exploit code has been identified at time of analysis. The vendor CVSS 4.0 rating is 7.1 (HIGH), but our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, arguing for a lower real-world priority given the non-default feature-specific pathway, the PR:L authentication requirement, and the narrow affected window that is closed by upgrading to 2026.8.1.
Private TLS keys stored by Froxlor before 2.3.13 are disclosed verbatim through the Certificates.get and Certificates.listing API commands, letting any authenticated API caller - including the lowest-privilege customer account - read the raw PEM private keys of their own domains, such as server-generated Let's Encrypt keys normally stored root-only (0600) and inaccessible to that customer, while a reseller account or an admin with the customers_see_all flag can pull other principals' keys through the same sink. Disclosed keys enable domain impersonation, passive decryption of captured TLS traffic, and active machine-in-the-middle attacks. The independently assessed vector (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects high confidentiality impact with cross-tenant scope but no direct integrity or availability loss, and no public exploit identified at time of analysis.
Cross-site request forgery in the Froxlor hosting control panel through 2.3.10 lets an unauthenticated attacker silently strip a logged-in panel user's two-factor authentication by luring them into following a crafted GET link such as /customer_index.php?page=2fa&action=delete, with no confirmation prompt, re-authentication, or CSRF token required; both the customer and admin 2FA handlers are affected. The practical impact is bounded: the attack only removes the second factor, and full account takeover additionally requires the victim's password to already be compromised, so this is a genuine but modest-severity CSRF rather than a standalone authentication bypass. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor addressed the flaw in Froxlor 2.3.12.
Authenticated API users in Froxlor before 2.3.12 can retrieve bcrypt password hashes for htpasswd-protected directories via the DirProtections.listing API command, enabling offline cracking and potential exposure of reused credentials. This credential disclosure affects installations that have configured protected directories; if none exist, no hashes are exposed. No public exploit identified at time of analysis, and the impact is confidentiality-only, limited by bcrypt's cost.
Froxlor through 2.3.10 fails to enforce the mail.allow_external_domains policy in the EmailSender.add API command, letting an authenticated customer with API access register an arbitrary external sender address for their mailbox even when the administrator has explicitly disabled external allowed-sender domains. The bypass only matters when the administrator has enabled the allowed-sender feature (mail.enable_allow_sender=1) while disabling external domains (mail.allow_external_domains=0), and the sender-spoofing impact materializes only if the generated mail configuration consumes the allowed-sender table; there is no public exploit identified at time of analysis, and exploitation requires valid low-privilege API credentials rather than being unauthenticated. A vendor-released patch is available in Froxlor 2.3.12, and our independent assessment rates this as a genuine but modest-severity authorization/policy-enforcement flaw rather than a high-urgency one.
Local privilege escalation to full root compromise on Froxlor panel hosts (2.3.10 and earlier) is achievable by an authenticated Froxlor customer holding a shell account, but only where the non-default setting system.allow_customer_shell=1 is enabled, which is a prerequisite for the attack to be reachable at all. The attacker wins a TOCTOU race in the root-run SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles) by atomically swapping their ~/.ssh directory for a symlink in the window between FileDir::makeCorrectDir()/makeCorrectFile() validation and the root-privileged file_put_contents/chown, causing the customer's public key to be appended to /root/.ssh/authorized_keys and /root/.ssh to be chowned to the customer; the cron re-runs every interval, so attempts are effectively unlimited until the race lands. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; it is a genuine root-compromise primitive but tightly gated by the non-default shell setting and by race timing, making it a moderate real-world priority rather than an emergency. The issue is fixed in Froxlor 2.3.12.
Privilege escalation in the Capgo Backend npm package (@capgo/backend) before 12.127.5 allows an authenticated attacker who already holds the org_admin role (priority rank 90) to demote org_super_admin role bindings (rank 95) down to a lower-privileged role such as org_member (rank 75) through the PATCH /private/role_bindings/:binding_id endpoint. Because the handler fails to verify the rank of the role currently bound to the target - and the prevent_last_super_admin_binding_delete safeguard fires only BEFORE DELETE, not on UPDATE - the attacker can strip every super administrator from the organization, leaving it without a super admin and enabling further governance/integrity abuse. Authentication with high privileges is required (CVSS vector PR:H), scope is limited to the attacker's own organization, and no public exploit has been identified at time of analysis; this is a bounded privileged-insider authorization defect rather than a remote unauthenticated compromise.
Authenticated organization admins in capgo.app can corrupt the organization's Stripe billing pointer (customer_id) by sending a direct UPDATE to the Supabase PostgREST API, bypassing the official organization update endpoint that excludes this column. The flaw requires an org admin with org.update_settings but without org.update_billing, and only affects the attacker's own organization's plan/billing state, not broader system data. No vendor patch was available at the time of the advisory, and no public exploit code has been identified.
Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room, allowing anyone already holding Builder-level access to a workspace to passively capture database passwords and API keys whenever a collaborator saves or deletes a table on an external datasource. The exposure is confidentiality-dominant (CVSS 4.0 base 7.0; VC:H/VI:L/VA:N) and requires the privileged Builder role (PR:H) - it is not reachable by unauthenticated users or by low-privilege consumers of published apps. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is available in 3.45.0.
A race condition in the Linux kernel cgroup task iterator (css_task_iter_next) can hand back a task_struct whose reference count has already dropped to zero, resulting in a use-after-free that a local attacker can turn into kernel memory corruption. Only systems running affected kernels built with cgroups are exposed, and the attacker must be able to read a cgroup.procs file while concurrently spawning and tearing down multi-threaded process groups - a low-privileged but purely local position (CVSS:3.1/AV:L/AC:H/PR:L). Exploitation is gated by an extremely narrow timing window tied to RCU grace periods and task teardown ordering, so the flaw is high-severity on paper but difficult to trigger reliably; EPSS is only 0.18% (7th percentile) and no public exploit code was identified at time of analysis.