CVE-2026-41300

תיאור (מקור, אנגלית)

OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote onboarding flows. Attackers can route gateway credentials to malicious endpoints by having their discovered URL survive the trust decline process into manual prompts requiring operator acceptance.

מדדים

CVSS 3.1

6.5 (MEDIUM) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVSS 4.0

6.9 (MEDIUM) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-29/7/2026

CWE

CWE-372

מוצרים מושפעים

openclaw: openclaw

קישורים

• https://github.com/openclaw/openclaw/security/advisories/GHSA-9f4w-67g7-mqwv Vendor Advisory
• https://github.com/openclaw/openclaw/commit/2a75416634837c21ed05b8c3ed906eb7a7‮… Patch
• https://www.vulncheck.com/advisories/openclaw-attacker-discovered-endpoint-pre‮… Third Party Advisory