high8.8
CVE-2026-41352
OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism.
Impact
OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | openclaw | <= 2026.3.28 | 2026.3.31 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openclaw | Openclaw | before 2026.3.31 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-xj9w-5r6q-x6v4
- https://github.com/openclaw/openclaw/security/advisories/GHSA-xj9w-5r6q-x6v4
- https://github.com/openclaw/openclaw/commit/3886b65ef21d02808c1a106fa1f9f69e22f71c32
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.31
- https://nvd.nist.gov/vuln/detail/CVE-2026-41352
- https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-node-scope-gate-bypass