In short
- CVE-2026-41378 is a HIGH (CVSS 8.8) vulnerability affecting openclaw (openclaw), openclaw.
- Chance of exploitation in the next 30 days (EPSS): 0.45%, higher than 38.7% of all vulnerabilities.
- Fix: update to 2026.3.31 or later.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
Current Maintainer Triage
- Status: narrow
- Normalized severity: high
- Assessment: v2026.3.28 still lets paired role=node clients drive node.event agent.request into broader gateway-side tool access than node RPCs, but critical is overstated because a trusted paired node foothold is already required.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
a77928b1087e90f2a8903f8e5aca6dec9237ac62 — 2026-03-30T14:22:15+01:00
OpenClaw thanks @AntAISecurityLab for reporting.
NVD description
OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted agent.request dispatch to achieve remote code execution on the gateway.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free