OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 23, 2026 · NIST NVD

   Detected

   OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.

2. Jun 17, 2026 · NIST NVD

   Updated

   OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.

Affected

• cpe openclaw/openclawversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-41352

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-41352

  OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairin

  nvd.nist.gov

References

• Patch · github.com
• Vendor Advisory · github.com
• Third Party Advisory · vulncheck.com