CVE-2026-41394CWE-862

OpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes

High · published April 28, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00507 · 42.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-04-28T18:09Z
EPSS history
Timeline
  • 28 APR 18:09Z
    OpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes
    cvelistv5