Authentication Bypass in OpenClaw Plugin by OpenClaw

CVE-2026-41394

What is CVE-2026-41394?

OpenClaw prior to version 2026.3.31 is vulnerable to an authentication bypass flaw that exposes operator runtime write scopes through plugin-auth HTTP routes. These routes can be accessed without any authentication, allowing attackers to execute privileged actions that are typically reserved for authenticated operators. This significant oversight could facilitate unauthorized manipulation of the system, highlighting the need for immediate updates to secure affected versions.

References