Trust-Decline Vulnerability in OpenClaw by OpenClaw Technologies
CVE-2026-41300

6.9MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
20 April 2026

What is CVE-2026-41300?

OpenClaw prior to version 2026.3.31 is susceptible to a trust-decline vulnerability, which allows attackers to retain maliciously discovered endpoints during remote onboarding processes. This vulnerability facilitates the routing of gateway credentials to these endpoints, potentially compromising the integrity of the onboarding flow. Operators may inadvertently accept risky URLs, as they survive the trust decline process, which could lead to unauthorized access and exploitation.

Affected Version(s)

OpenClaw 0 < 2026.3.31

OpenClaw 2026.3.31

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/2a75416634837...
patch
https://www.vulncheck.com/advisories/openclaw-attacker-di...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zsx (@zsxsoft)
KeenSecurityLab
.