Is there a patch available for CVE-2026-41393?

Yes, a patch is available for CVE-2026-41393. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-41393

Q: What is the CVSS score of CVE-2026-41393?

CVE-2026-41393 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26101 MEDIUM

Origin Validation Error (CWE-346)

2026-04-28 VulnCheck

GHSA-q9w8-cf67-r238

Information Disclosure Openclaw

5.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 20:07 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

4.8 (MEDIUM) 5.9 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26101

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:09 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-tailnet position and CA-trusted endpoint access can exfiltrate operator credentials through DNS steering manipulation.

AnalysisAI

OpenClaw before version 2026.3.31 accepts arbitrary tailnet peers as DNS authorities due to improper validation in its wide-area discovery mechanism, enabling attackers positioned within the same tailnet with CA-trusted endpoint access to manipulate DNS resolution and exfiltrate operator credentials. The vulnerability requires adjacent network access, high attack complexity, and user interaction, but results in high confidentiality impact through credential theft. No active exploitation has been publicly confirmed at the time of analysis.

Technical ContextAI

OpenClaw implements a tailnet-based peer discovery system that dynamically configures DNS authorities for name resolution. The vulnerability stems from insufficient validation of DNS authority peers during wide-area discovery (CWE-346: Origin Validation Error), allowing any tailnet-positioned peer with CA-trust to be accepted without proper authentication checks. Attackers can exploit this by steering DNS queries to attacker-controlled endpoints, intercepting legitimate operator queries and exfiltrating credentials through DNS response manipulation. The affected versions before 2026.3.31 fail to properly validate the origin and legitimacy of peer DNS authority claims, creating a trust boundary violation.

RemediationAI

Upgrade OpenClaw to version 2026.3.31 or later, which implements proper DNS authority peer validation. The fix is available via GitHub commit a23c33a681f8c1b22dc793995acc4c5c4b568346 referenced in the official security advisory (https://github.com/openclaw/openclaw/security/advisories/GHSA-q9w8-cf67-r238). Until patching is possible, implement network segmentation to restrict operator credentials and sensitive data exposure to isolated segments, limit CA-trust delegation to verified endpoints only, and monitor DNS query patterns for anomalous steering behavior. Disable wide-area discovery if not required for operations, accepting reduced functionality in favor of reduced attack surface.