Em resumo
- CVE-2026-41352 é uma vulnerabilidade ALTO (CVSS 8.8) que afeta openclaw (openclaw), openclaw.
- Chance de exploração nos próximos 30 dias (EPSS): 0.54%, maior que 45.7% das vulnerabilidades.
- Correção: atualize para 2026.3.31 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Device-Paired Node Skips Node Scope Gate → Host RCE.md
Current Maintainer Triage
- Status: open
- Normalized severity: high
- Assessment: Real in shipped v2026.3.28 because a merely device-paired node could expose node commands without node pairing, but high is sufficient given the pairing/setup prerequisites.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
3886b65ef21d02808c1a106fa1f9f69e22f71c32 — 2026-03-30T17:29:28+01:00
OpenClaw thanks @AntAISecurityLab for reporting.
NVD description
OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free