CVE-2026-41352 HIGH

CVE-2026-41352: OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass

Vendor Openclaw

Product OpenClaw

Weakness CWE-862 · Missing authorization

Published April 23, 2026

Last update April 24, 2026

View on NVD All CVEs

CVSS base score

7.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.

Key dates

02Disclosure timeline

April 23, 2026 CVE published

April 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-41352 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2026-42541 Kubewarden: RBAC Reconnaissance via unchecked can_i host capability call CVE-2025-68993 WordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerability CVE-2024-51817 WordPress Combo WP Rewrite Slugs plugin <= 1.0 - Settings Change vulnerability CVE-2025-15043 The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control CVE-2023-35093 WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control