En bref
- CVE-2026-41394 est une vulnérabilité ÉLEVÉE (CVSS 8.2) touchant openclaw (openclaw), openclaw.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.29%, plus élevée que 21.3% des vulnérabilités.
- Correctif : mettre à jour vers 2026.3.31 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Unauthenticated plugin-auth HTTP routes receive operator runtime scopes
Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: v2026.3.28 still gives auth:"plugin" routes operator WRITE_SCOPE, but impact should stay limited to plugin routes that actually touch privileged runtime actions before plugin auth completes.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
2a1db0c0f1fa375004a95ba0ef030534790a6d47 — 2026-04-01T00:20:49+09:00
OpenClaw thanks @davidluzsilva for reporting.
NVD description
OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free