VULNERABILITY INTELLIGENCE

CVE-2026-41342

CVSS score7.3 HIGH
EPSS probability0.13%
CISA KEVNot currently listed
Published2026-04-23
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Description

OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints without explicit trust confirmation. Attackers can spoof discovery endpoints to redirect onboarding toward malicious gateways and capture gateway credentials or traffic.

Weakness classification

  • disclosure@vulncheck.com: CWE-346

Primary references