Chia Min Jun Lennon

**Name of the Vulnerable Software and Affected Versions** Hermes WebUI versions prior to 0.51.521 **Description** An authorization bypass occurs during the session import process. The `/api/session/import` endpoint validates the workspace of an imported session under the active named profile but fails to set the profile when constructing the Session object. Consequently, the session is saved with a null profile. Since the profile authorization check treats a null profile as the default profile, a user assigned to the default profile can export the session transcript and use the session identifier to access files from the named profile's workspace, bypassing profile isolation. **Recommendations** Update Hermes WebUI to version 0.51.521 or later.

**Name of the Vulnerable Software and Affected Versions** DeepTutor versions prior to 1.4.10 **Description** An authorization bypass exists that allows low-privilege users to invoke unrestricted Model Context Protocol (MCP) tools. This occurs because the `allowed mcp tools()` function in deeptutor/multi user/tool access.py returns None instead of a denied result when `mcp tools` is omitted from a user's grant. Consequently, attackers or prompt-injected content within a user session can enumerate and invoke any configured MCP tool, such as filesystem, shell, and browser servers, leading to unauthorized access to sensitive deployment resources. **Recommendations** Update to version 1.4.10 or later.

**Name of the Vulnerable Software and Affected Versions** NanoClaw versions prior to 2.1.17 **Description** An issue exists in the `forwardAttachedFiles` function where the host validates attachment filenames using only `isSafeAttachmentName` before performing a copy operation with `fs.copyFileSync`. Because `fs.copyFileSync` follows symbolic links (symlinks)—which are pointers to other files or directories—without containment checks, container-controlled agents can exfiltrate arbitrary files readable by the host. **Recommendations** Update to version 2.1.17 or later.

**Name of the Vulnerable Software and Affected Versions** NanoClaw versions prior to 2.1.17 **Description** A privilege escalation issue exists in the `create agent` delivery-action handler. The handler performs privileged central-database writes without implementing host-side authorization checks. This allows confined agent containers to invoke `create agent` to create arbitrary agent groups, container configurations, and destinations, enabling them to escalate privileges beyond their intended confinement boundary. **Recommendations** Update to version 2.1.17 or later.

**Name of the Vulnerable Software and Affected Versions** OpenHarness ohmo gateway (affected versions not specified) **Description** The `/resume` and `/summary` slash commands in the gateway default the `remote invocable` property to True. This allows admitted remote senders to enumerate and load arbitrary session snapshots by ID. An attacker can use this to access victim snapshots through shared gateway channels, potentially exposing private prompts, credentials, tool output, and file paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NanoClaw versions prior to 2.1.0 **Description** A privilege escalation issue exists in the channel-registration approval flow. The `handleChannelApprovalResponse()` function fails to validate whether an administrator has the necessary privileges over the target agent groups. This allows scoped admins to submit forged or stale connect callback values to link messaging channels to agent groups outside their scope, potentially leading to unauthorized observation or control of restricted agent group activity. **Recommendations** Update NanoClaw to version 2.1.0 or later. As a temporary mitigation, restrict the use of the `handleChannelApprovalResponse()` function for scoped administrators.

**Name of the Vulnerable Software and Affected Versions** NanoClaw versions prior to 2.1.17 **Description** A privilege escalation issue exists in the `handleApprovalsResponse()` function. The system fails to verify the authorization of the responder role, allowing attackers who possess a valid `questionId` to approve or reject privileged actions, such as package installations, by submitting approval response payloads. **Recommendations** Update to version 2.1.17 or later. As a temporary mitigation, restrict access to the `handleApprovalsResponse()` function to authorized users only.

**Name of the Vulnerable Software and Affected Versions** OpenViking versions prior to 0.1.19 **Description** The software contains a broken access control issue. Unauthenticated attackers can gain ROOT privileges when the `root api key` configuration is not set. Attackers can send requests to protected API endpoints without authentication headers, allowing access to administrative functions. These functions include account management, resource operations, and system configuration. The vulnerable API endpoints are accessible without proper authentication when the `root api key` is omitted. **Recommendations** Update to version 0.1.19 or later. Ensure the `root api key` configuration is properly set to prevent unauthorized access.