CVE-2026-41352CWE-862

OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass

High · published April 23, 2026

CVSS v4.0
7.7
EPSS
1%
Percentile
63.9
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01049 · 63.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-04-23T21:58Z
EPSS history
Timeline
  • 23 APR 21:58Z
    OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass
    cvelistv5