CVE-2026-41377

MEDIUM

OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation

Title source: cna
STIX 2.1

Description

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings.

References (6)

Core 6
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-cwq8-6f96-g3q4)
https://github.com/openclaw/openclaw/security/advisories/GHSA-cwq8-6f96-g3q4
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation
https://www.vulncheck.com/advisories/openclaw-fail-open-security-scan-bypass-in-plugin-installation

Scores

CVSS v3 4.6
EPSS 0.0023
EPSS Percentile 13.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-636
Status published
Products (4)
npm/openclaw 0 - 2026.3.31npm
OpenClaw/OpenClaw < 2026.3.31
openclaw/openclaw < 2026.3.31
OpenClaw/OpenClaw 2026.3.31
Published Apr 28, 2026
Tracked Since Apr 29, 2026