CVE-2026-41342

Опубликовано: 23 апр. 2026

Источник: nvd

CVSS3: 7.3

CVSS3: 8.1

EPSS Низкий

Описание

OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints without explicit trust confirmation. Attackers can spoof discovery endpoints to redirect onboarding toward malicious gateways and capture gateway credentials or traffic.

Ссылки

https://github.com/openclaw/openclaw/security/advisories/GHSA-3cw3-5vxw-g2h3
Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-unauthenticated-discovery-endpoint-credential-exfiltration-via-remote-onboarding
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

Версия до 2026.3.28 (исключая)

EPSS

Процентиль: 3%

0.00126

Низкий

7.3 High

CVSS3

8.1 High

CVSS3

Дефекты

CWE-346

Связанные уязвимости

GHSA-3cw3-5vxw-g2h3

CVSS3: 7.3

github

5 месяцев назад

OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

EPSS

Процентиль: 3%

0.00126

Низкий

7.3 High

CVSS3

8.1 High

CVSS3

Дефекты

CWE-346