PT-2026-35762 · Openclaw · Openclaw

Davidluzsilva · CVE-2026-41377 · Published 2026-04-02 · Updated 2026-05-01

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A fail-open issue exists in the plugin installation flow where security scan failures do not block the installation process. This allows attackers to install untrusted plugins if operators choose to proceed despite visible scan warnings.

Recommendations Update to version 2026.3.31.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-636

Related Identifiers

CVE-2026-41377

GHSA-CWQ8-6F96-G3Q4

Affected Products

Openclaw

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41377.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-cwq8-6f96-g3q4 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/bf96c67fd1954740aeabfadc7cfe3098bcfc6b68 · Patch
• https://github.com/openclaw/openclaw/commit/0d7f1e2c84eca65df7dee890d9c30e2a841c030a · Patch
• https://github.com/openclaw/openclaw/commit/7a953a52271b9188a5fa830739a4366614ff9916 · Patch
• https://github.com/openclaw/openclaw/commit/44b993613601280d46a5b88190e46669fc13d669 · Patch
• https://osv.dev/vulnerability/CVE-2026-41377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41377 · Security Note
• https://osv.dev/vulnerability/GHSA-cwq8-6f96-g3q4 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/0d7f1e2c84eca65df7dee890d9c30e2a841c030a · Note
• https://github.com/openclaw/openclaw/44b993613601280d46a5b88190e46669fc13d669 · Note
• https://github.com/openclaw/openclaw/bf96c67fd1954740aeabfadc7cfe3098bcfc6b68 · Note
• https://vulncheck.com/advisories/openclaw-fail-open-security-scan-bypass-in-plugin-installation · Note
• https://twitter.com/CVEnew/status/2049227543484432702 · Twitter Post