Openclaw CVE-2026-41300

Exploitation requires the following specific conditions: (1) Remote onboarding feature must be active and the target system must initiate or participate in an onboarding flow, (2) Attacker must be able to influence endpoint discovery by either controlling network responses (MITM position) or by having injected a malicious endpoint URL into the discovery process, (3) An operator must interact with the onboarding workflow and encounter the trust decline prompt for the attacker's endpoint, (4) The same operator or a different operator must later proceed to the manual approval phase and accept the endpoint URL that was previously declined. The vulnerability does NOT require authentication (PR:N), does NOT require special privileges, and does NOT require non-default configuration - it affects default onboarding flows. However, exploitation is limited to scenarios where operators can be influenced to accept attacker-controlled endpoints, and the attacker must maintain presence or influence during the discovery phase. Organizations using OpenClaw in fully air-gapped or zero-trust endpoint environments face reduced risk.

This vulnerability carries moderate-to-high real-world risk despite the medium CVSS score. The CVSS vector indicates network-accessible exploitation (AV:N/AC:L) requiring only user interaction (UI:A) with no authentication needed (PR:N), making it broadly exploitable. The impact is specifically confidentiality of gateway credentials (VC:H), which are typically sensitive authentication tokens or connection strings. However, the requirement for user interaction (UI:A) limits attack scope to scenarios where an attacker can influence endpoint discovery or network conditions during onboarding. The lack of EPSS score, KEV status, or public exploit data suggests limited active exploitation at analysis time, but the logical simplicity of the vulnerability (URL persistence across trust boundaries) and the high-value target (gateway credentials) indicate it poses real risk to organizations actively deploying OpenClaw's remote onboarding feature. The vulnerability is not automatable without environmental manipulation (network positioning or endpoint discovery influence), which moderately constrains widespread exploitation potential. Organizations using OpenClaw should prioritize patching based on exposure to untrusted networks during onboarding rather than treating this as emergency-critical.

An attacker positions themselves on the network path during a target organization's OpenClaw remote onboarding process (via ARP spoofing, DNS hijacking, or BGP interception). During endpoint discovery, the attacker injects a malicious endpoint URL pointing to their server. When the operator declines trust for this endpoint in the initial discovery phase, the application fails to remove it from the workflow state. Later, when the operator proceeds to manual approval of endpoints, the attacker's URL reappears in the approval prompt. The operator, seeing the URL has survived to the approval stage, may incorrectly assume it passed validation and accepts it, causing gateway credentials to be routed to the attacker's infrastructure.