PT-2026-35786 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-41403

Mitre

CVSS v3.1

2.9

Low

AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly identified as local loopback traffic, circumventing intended remote viewer restrictions.

Fix

Weakness Enumeration

CWE-807

Related Identifiers

CVE-2026-41403

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/commit/30a1690323088fd291abd11643a264a6828a002c · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41403 · Security Note
• https://twitter.com/CVEnew/status/2049227517773377668 · Twitter Post
• https://vulncheck.com/advisories/openclaw-access-control-bypass-via-proxied-remote-request-misclassification · Note