openclaw @openclaw/diagnostics-prometheus vulnerabilities

Latest openclaw @openclaw/diagnostics-prometheus CVEs

Newest publication first

1. CVE-2026-100525 OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass

   Published 2026-09-26

   Medium·CVSS 5.3 EPSS 0.25%

   The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a call...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.