VULNERABILITY INTELLIGENCE

CVE-2026-41352

CVSS score7.7 HIGH
EPSS probability0.54%
CISA KEVNot currently listed
Published2026-04-23
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.

Weakness classification

  • CWE-862: Missing Authorization

Primary references