By weakness (CWE)

CWE-1023: related vulnerabilities

CVEs classified under CWE-1023. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

3 published vulnerabilities

• CVE-2026-53839MEDIUM 6.5

  OpenClaw versions before 2026.5.7 contain a flaw in how they validate hostnames when processing retry requests. Instead of checking for an exact match to trusted hosts, the software accepts any hostname that starts with the trusted hostname prefix. An authenticated attacker can exploit this by creating a crafted hostname that begins with a legitimate server name—for example, turning 'trusted.com' into 'trusted.com.evil.net'—and trick the system into sending sensitive authentication credentials to their malicious endpoint.

• CVE-2026-53859MEDIUM 6.5

  OpenClaw versions before 2026.5.26 have a hostname validation flaw that allows authenticated attackers to bypass network access controls. The vulnerability exploits how the application validates hostnames in URLs derived from model or workspace settings. By appending a trailing dot to a hostname (e.g., "blocked-host.com." instead of "blocked-host.com"), attackers can circumvent blocklist policies that administrators set up to restrict which systems OpenClaw can reach. This is a logic error, not a cryptographic weakness, and requires existing user access to exploit.

• CVE-2026-48587LOW 3.1

  Django's cache handling function has a flaw where whitespace in HTTP Vary headers isn't properly cleaned up before comparison. An attacker can exploit this by crafting requests that cause the application to serve cached responses intended for different users, potentially leaking sensitive information. The vulnerability affects Django 5.2 before version 5.2.15 and 6.0 before version 6.0.6, though older unsupported versions may also be vulnerable.