Skip to content
CVSS 7.3 · HIGH

CVE-2026-41342

OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints without explicit trust confirmation. Attackers can spoof discovery endpoints to redirect onboarding toward malicious gateways and capture gateway credentials or traffic.

Ver en NVD

Análisis

OpenClaw is not a standard tool in the common web, mobile, or infrastructure stacks used by this community. While the vulnerability allows for authentication bypass and credential theft, the product's low adoption rate does not justify an alert for the general developer population.

Severidad

Puntaje: 7.3(HIGH)
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
AV: ADJACENT_NETWORK
AC: LOW
PR: NONE
UI: REQUIRED
S: UNCHANGED
C: HIGH
I: HIGH
A: NONE
Tipo de falla (CWE): CWE-346

EPSS

Probabilidad de explotación (próx. 30 días): 0.0001 (0.0%)
Percentil: 1.2%
EPSS: 2026-05-06

Afecta

openclaw:openclaw

Descripción técnica

OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints without explicit trust confirmation. Attackers can spoof discovery endpoints to redirect onboarding toward malicious gateways and capture gateway credentials or traffic.

Publicada: 23/4/2026, 22:16:40
Última modificación: 29/4/2026, 15:55:12

Referencias

InicioEventosBlogRecursosEquipo