VULNERABILITY INTELLIGENCE

CVE-2026-41393

CVSS score5.9 MEDIUM
EPSS probability0.12%
CISA KEVNot currently listed
Published2026-04-28
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Description

OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-tailnet position and CA-trusted endpoint access can exfiltrate operator credentials through DNS steering manipulation.

Weakness classification

  • CWE-346: Origin Validation Error

Primary references