Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-41345
5.3 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): NONE
- User interaction (UI): REQUIRED
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
Activity log
- Created suggestion
OpenClaw < 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media Download
OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects. Attackers can exploit this by crafting malicious cross-origin redirect chains to intercept sensitive authorization credentials intended for legitimate requests.
References
-
GitHub Security Advisory (GHSA-68v4-hmwv-f43h) vendor-advisory
-
Patch Commit patch
Affected products
OpenClaw
- ==2026.3.31
- <2026.3.31
Package maintainers
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
-
@chrisportela Chris Portela <chris@chrisportela.com>