Is there a patch available for CVE-2026-41376?

Yes, a patch is available for CVE-2026-41376. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-41376

Q: What is the CVSS score of CVE-2026-41376?

CVE-2026-41376 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26085 LOW

Origin Validation Error (CWE-346)

2026-04-28 VulnCheck

Authentication Bypass Openclaw

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 20:06 vuln.today

Severity Changed

Apr 28, 2026 - 19:52 NVD

MEDIUM LOW

CVSS changed

Apr 28, 2026 - 19:52 NVD

5.4 (MEDIUM) 2.3 (LOW)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26085

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:09 nvd

LOW 2.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to properly validate message senders. Attackers can fetch thread-root and reply context messages that should be filtered by sender allowlists, bypassing access controls.

AnalysisAI

OpenClaw before version 2026.3.31 fails to properly validate message senders in Matrix thread root and reply context handling, allowing remote unauthenticated attackers to bypass sender allowlists and access filtered messages. The vulnerability requires user interaction and has low attack complexity, but impact is limited to information disclosure of message context that should have been restricted by access controls.

Technical ContextAI

OpenClaw is a Matrix client or integration component that implements sender-based allowlist filtering to control which message contexts users can access in threaded conversations. The vulnerability exists in the thread root and reply context retrieval logic, where message sender validation is insufficient. CWE-346 (Origin Validation Error) indicates the root cause is improper verification of message origin or sender identity when applying allowlist policies. Affected versions use CPE a:openclaw:openclaw with versions prior to 2026.3.31. The vulnerability allows attackers to fetch contextual messages (thread roots and replies) that should be filtered by the sender allowlist, effectively bypassing the intended access control mechanism.

RemediationAI

Upgrade OpenClaw to version 2026.3.31 or later to remediate the sender validation bypass. The vendor patch is available via GitHub commit 8a563d603b70ef6338915f0527bee87282c3bad5, which implements proper message sender validation in thread root and reply context handling. Organizations unable to immediately upgrade should restrict access to OpenClaw features that expose thread context, or limit Matrix integration to public or fully trusted channels where allowlist filtering is less critical. No compensating controls can fully replicate the intended allowlist functionality; patching is the primary remediation. For detailed patching instructions and configuration recommendations, refer to the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-rg8m-3943-vm6q.