CVE-2026-41403

LOW

OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification

Title source: cna
STIX 2.1

Description

OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly identified as local loopback traffic, circumventing intended remote viewer restrictions.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-3xv9-89fm-7h4r)
https://github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4r
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification
https://www.vulncheck.com/advisories/openclaw-access-control-bypass-via-proxied-remote-request-misclassification

Scores

CVSS v3 2.9
EPSS 0.0026
EPSS Percentile 17.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-807
Status published
Products (4)
npm/openclaw 0 - 2026.3.31npm
OpenClaw/OpenClaw < 2026.3.31
openclaw/openclaw < 2026.3.31
OpenClaw/OpenClaw 2026.3.31
Published Apr 28, 2026
Tracked Since Apr 29, 2026