PT-2026-35789 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-41406

Mitre

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fetched quoted, root, and thread context messages to bypass sender allowlist restrictions and retrieve unauthorized content.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-41406

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-877v-w3f5-3pcq · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/f45e5a6569aab1d58cc6de25b19f1dc4c8779b85 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41406 · Security Note
• https://twitter.com/CVEnew/status/2049227514577322481 · Twitter Post
• https://vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-thread-history-and-quoted-messages · Note