CVE-2026-41352
CVE-2026-41352 · OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.
CVSS 7.7 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-xj9w-5r6q-x6v4
- https://github.com/openclaw/openclaw/commit/3886b65ef21d02808c1a106fa1f9f69e22f71c32
- https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-node-scope-gate-bypass
- https://nvd.nist.gov/vuln/detail/CVE-2026-41352