요약
- CVE-2026-41394은(는) openclaw (openclaw), openclaw에 영향을 주는 높음 (CVSS 8.2) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.29%, 전체 취약점의 21.3%보다 높음.
- 조치: 2026.3.31 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Unauthenticated plugin-auth HTTP routes receive operator runtime scopes
Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: v2026.3.28 still gives auth:"plugin" routes operator WRITE_SCOPE, but impact should stay limited to plugin routes that actually touch privileged runtime actions before plugin auth completes.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
2a1db0c0f1fa375004a95ba0ef030534790a6d47 — 2026-04-01T00:20:49+09:00
OpenClaw thanks @davidluzsilva for reporting.
NVD description
OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free