PT-2026-33867

CVE-2026-41300

Published

2026-04-03

Updated

2026-04-27

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description An issue in remote onboarding flows allows attacker-discovered endpoints to be preserved after a trust decline process. This enables attackers to route gateway credentials to malicious endpoints by ensuring their discovered URL survives into manual prompts that require operator acceptance.

Recommendations Update to version 2026.3.31 or later.

Exploitability

Exploit

Fix

Researchers

Vendors

Affected products

Weakness enumeration

CWE-670: Always-Incorrect Control Flow Implementation

CWE-372: Incomplete Internal State Distinction

Related identifiers

CVE-2026-41300