PT-2026-35762 · Openclaw · Openclaw

Davidluzsilva · Published 2026-04-02 · Updated 2026-05-01 · CVE-2026-41377

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A fail-open issue exists in the plugin installation flow where security scan failures do not block the installation process. This allows attackers to install untrusted plugins if operators choose to proceed despite visible scan warnings.

Recommendations Update to version 2026.3.31.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-636

Related Identifiers

CVE-2026-41377

GHSA-CWQ8-6F96-G3Q4

Affected Products

Openclaw

References · 14

• https://github.com/openclaw/openclaw/security/advisories/GHSA-cwq8-6f96-g3q4 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/7a953a52271b9188a5fa830739a4366614ff9916 · Patch
• https://github.com/openclaw/openclaw/commit/44b993613601280d46a5b88190e46669fc13d669 · Patch
• https://github.com/openclaw/openclaw/commit/bf96c67fd1954740aeabfadc7cfe3098bcfc6b68 · Patch
• https://github.com/openclaw/openclaw/commit/0d7f1e2c84eca65df7dee890d9c30e2a841c030a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41377 · Security Note
• https://osv.dev/vulnerability/GHSA-cwq8-6f96-g3q4 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/44b993613601280d46a5b88190e46669fc13d669 · Note
• https://github.com/openclaw/openclaw/0d7f1e2c84eca65df7dee890d9c30e2a841c030a · Note
• https://github.com/openclaw/openclaw/bf96c67fd1954740aeabfadc7cfe3098bcfc6b68 · Note
• https://twitter.com/CVEnew/status/2049227543484432702 · Twitter Post
• https://vulncheck.com/advisories/openclaw-fail-open-security-scan-bypass-in-plugin-installation · Note
• https://t.me/cveNotify/161761 · Telegram Post