Kurz gesagt
- CVE-2026-41378 ist eine Schwachstelle (HOCH (CVSS 8.8)) in openclaw (openclaw), openclaw.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.45%, höher als bei 38.7% aller Schwachstellen.
- Abhilfe: auf 2026.3.31 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
Current Maintainer Triage
- Status: narrow
- Normalized severity: high
- Assessment: v2026.3.28 still lets paired role=node clients drive node.event agent.request into broader gateway-side tool access than node RPCs, but critical is overstated because a trusted paired node foothold is already required.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
a77928b1087e90f2a8903f8e5aca6dec9237ac62 — 2026-03-30T14:22:15+01:00
OpenClaw thanks @AntAISecurityLab for reporting.
NVD description
OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted agent.request dispatch to achieve remote code execution on the gateway.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free