CWE-636 Not Failing Securely ('Failing Open')

@bytebase/dbhub's read-only mode does not prevent database writes

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

AIIR verification and policy gates could report success without enforcing the control (fail-open)

OpenClaw: Mattermost handlers could fall open when channel type was missing

Duplicate Advisory: OpenClaw: Mattermost handlers could fall open when channel type was missing

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

nono-cli'scregistry pack verification can fail open when provenance metadata is absent

JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms

guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

OpenClaw: Empty-scope device re-pairing could confuse caller scope containment

Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment

MCP Registry: OCI validator skips ownership check on upstream rate limits

net-imap vulnerable to STARTTLS stripping via invalid response timing

OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts

OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open)

OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes

Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions

free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions

free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors

OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode