CVE-2026-41346

MEDIUM

OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcement

Title source: cna

Description

OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing challenges on unaffected accounts, causing denial of service.

References (3)

[Vendor Advisory] https://github.com/openclaw/openclaw/security/advisories/GHSA-wwfp-w96m-c6x8

[Patch] https://github.com/openclaw/openclaw/commit/9bc1f896c8cd325dd4761681e9bdb8c425f69785

View Patch ZIP pw:eip

[Third Party Advisory] https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-improper-pending-pairing-request-cap-enforcement

Scores

CVSS v3 5.3

EPSS 0.0009

EPSS Percentile 26.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

CWE

CWE-799

Status published

Products (2)

OpenClaw/OpenClaw 2026.2.26 - 2026.3.31

OpenClaw/OpenClaw 2026.3.31

Published Apr 23, 2026

Tracked Since Apr 24, 2026