PT-2026-34773 · Openclaw · Openclaw

Keensecuritylab + 1 · CVE-2026-41342 · Published 2026-03-31 · Updated 2026-04-25

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description An authentication bypass exists in the remote onboarding component. The system persists unauthenticated discovery endpoints without requiring explicit trust confirmation. This allows attackers to spoof discovery endpoints to redirect onboarding processes toward malicious gateways, potentially capturing gateway credentials or traffic.

Recommendations Update to version 2026.3.28.

Exploit

Fix

Origin Validation Error

Improper Authentication

Missing Authorization

Weakness Enumeration

CWE-346

CWE-287

CWE-862

Related Identifiers

CVE-2026-41342

GHSA-3CW3-5VXW-G2H3

GHSA-GV2F-Q4WP-FVH5

Affected Products

Openclaw

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41342.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3cw3-5vxw-g2h3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41342 · Security Note
• https://osv.dev/vulnerability/GHSA-3cw3-5vxw-g2h3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41342 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gv2f-q4wp-fvh5 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/d6affb17d85f5f5ab08ef9f2b994b257af12e75a · Note
• https://vulncheck.com/advisories/openclaw-unauthenticated-discovery-endpoint-credential-exfiltration-via-remote-onboarding · Note
• https://twitter.com/CVEnew/status/2048168366142329175 · Twitter Post