CVE-2026-41403

תיאור (מקור, אנגלית)

OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly identified as local loopback traffic, circumventing intended remote viewer restrictions.

מדדים

CVSS 3.1

4.0 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS 4.0

6.3 (MEDIUM) מקור הציון: CNA CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-30/7/2026

CWE

CWE-807

מוצרים מושפעים

openclaw: openclaw

קישורים

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4r Vendor Advisory
• https://github.com/openclaw/openclaw/commit/30a1690323088fd291abd11643a264a682‮… Patch
• https://www.vulncheck.com/advisories/openclaw-access-control-bypass-via-proxie‮… Third Party Advisory