CVE-2026-41352: OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass
Published Apr 23, 2026
·Updated
OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.
Affected Software
2 affected components
OpenClaw<2026.3.31
OpenClaw Openclaw Node.js<2026.3.31
Remediation
Event History
Apr 23, 2026
CVE Published
via MITRE·09:58 PM
Data Sourced
via MITRE·09:58 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-41352?
CVE-2026-41352 is classified as a high-severity vulnerability due to its potential to enable remote code execution.
2
How do I fix CVE-2026-41352?
To fix CVE-2026-41352, update OpenClaw to version 2026.3.31 or later.
3
What systems are affected by CVE-2026-41352?
CVE-2026-41352 affects all versions of OpenClaw prior to 2026.3.31.
4
Can CVE-2026-41352 be exploited remotely?
Yes, CVE-2026-41352 can be exploited remotely by attackers with valid device pairing credentials.
5
What type of attack does CVE-2026-41352 enable?
CVE-2026-41352 enables remote code execution attacks through a node scope gate bypass.