要点
- CVE-2026-41375 は openclaw (openclaw), openclaw に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.33%（全脆弱性の 26.4% より高い）。
- 対処：2026.3.28 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| openclaw | < 2026.3.28
| 2026.3.28
|
| openclaw npm | < 2026.3.28
| 2026.3.28
|
概要
Summary
/phone arm//phone disarm Bypasses operator.admin Scope Check for External Channels
Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: Maintainers accepted this issue, fixed it in aa66ae1fc797d3298cc409ed2c5da69a89950a45 on 2026-03-27, and that fix shipped in v2026.3.28, so normalize it as a fixed released draft rather than a close-by-trust-model call.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.24
- Patched versions:
>= 2026.3.28
- First stable tag containing the fix:
v2026.3.28
Fix Commit(s)
aa66ae1fc797d3298cc409ed2c5da69a89950a45 — 2026-03-27T20:35:42Z
Release Process Note
- The fix is already present in released version
2026.3.28.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.
Thanks @AntAISecurityLab for reporting.
NVD の説明
OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin scope checks for external channels. Attackers can bypass authentication restrictions to arm or disarm phone channels without proper administrative privileges.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン