CVE-2026-41346: OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcement
OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing challenges on unaffected accounts, causing denial of service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41346?
CVE-2026-41346 is classified as a Denial of Service vulnerability which can disrupt service availability.
How do I fix CVE-2026-41346?
To fix CVE-2026-41346, upgrade OpenClaw to version 2026.3.31 or later where the pending pairing-request cap is enforced correctly.
What impact does CVE-2026-41346 have on OpenClaw?
CVE-2026-41346 allows remote attackers to exhaust the shared pending window, potentially crashing services and denying access to legitimate users.
Who is affected by CVE-2026-41346?
Any user or system utilizing OpenClaw versions from 2026.2.26 up to, but not including, 2026.3.31 is affected by CVE-2026-41346.
What types of attacks can exploit CVE-2026-41346?
CVE-2026-41346 can be exploited through crafted pending pairing requests, leading to resource exhaustion and service availability issues.