CVE-2026-41403CWE-807

OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification

Medium · published April 28, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly identified as local loopback traffic, circumventing intended remote viewer restrictions.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00368 · 29.4th percentile
Weakness
CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2026-04-28T18:10Z
EPSS history
Timeline
  • 28 APR 18:10Z
    OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification
    cvelistv5