CVE-2026-41393 MEDIUM

CVE-2026-41393: OpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery

Vendor Openclaw

Product OpenClaw

Weakness CWE-346 · Origin validation

Published April 28, 2026

Last update April 29, 2026

View on NVD All CVEs

CVSS base score

5.9/10

Attack vector Adjacent

Attack complexity High

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-tailnet position and CA-trusted endpoint access can exfiltrate operator credentials through DNS steering manipulation.

Key dates

02Disclosure timeline

April 28, 2026 CVE published

April 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-41393 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/346.html

Related vulnerabilities

04Related CVE

CVE-2018-5400 The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices, resulting in an origin validation error CVE-2026-41358 OpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Context CVE-2025-37734 Kibana Origin Validation Error CVE-2024-12973 Host Header Injection in Akinsoft's OctoCloud CVE-2023-3581 WebSockets accept connections from HTTPS origin