PT-2026-34766 · Openclaw · Openclaw

Wang Dong · Published 2026-04-03 · Updated 2026-04-25 · CVE-2026-41335

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description An information disclosure issue exists in the Control Interface bootstrap JSON. This allows attackers to extract sensitive fingerprinting information, specifically version and assistant agent identifiers, from the Control UI bootstrap payload to identify system versions and agent configurations.

Recommendations Update to version 2026.3.31.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-497

Related Identifiers

CVE-2026-41335

GHSA-FJM8-MGC9-MF65

GHSA-HR8G-2Q7X-3F4W

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-hr8g-2q7x-3f4w · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/c5c10adc022f42eb75ebb3bf364dd607738683b3 · Patch
• https://osv.dev/vulnerability/GHSA-hr8g-2q7x-3f4w · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fjm8-mgc9-mf65 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41335 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-information-disclosure-via-control-ui-bootstrap-json · Note
• https://twitter.com/CVEnew/status/2048168372794478878 · Twitter Post