CVE-2026-41406CWE-639

OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages

Low · published April 28, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
32.9
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fetched quoted, root, and thread context messages to bypass sender allowlist restrictions and retrieve unauthorized content.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00398 · 32.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-28T18:10Z
EPSS history
Timeline
  • 28 APR 18:10Z
    OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages
    cvelistv5