PT-2026-34773

CVE-2026-41342

Published

2026-03-31

Updated

2026-04-25

Description by

CVSS 3.1

8.1

High

MetricsAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description An authentication bypass exists in the remote onboarding component. The system persists unauthenticated discovery endpoints without requiring explicit trust confirmation. This allows attackers to spoof discovery endpoints to redirect onboarding processes toward malicious gateways, potentially capturing gateway credentials or traffic.

Recommendations Update to version 2026.3.28.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Nathan

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization