Is there a patch available for CVE-2026-41402?

Yes, a patch is available for CVE-2026-41402. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-41402

Q: What is the CVSS score of CVE-2026-41402?

CVE-2026-41402 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26109 LOW

Use of Incorrectly-Resolved Name or Reference (CWE-706)

2026-04-28 VulnCheck

Authentication Bypass Openclaw

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 20:07 vuln.today

Severity Changed

Apr 28, 2026 - 19:52 NVD

MEDIUM LOW

CVSS changed

Apr 28, 2026 - 19:52 NVD

4.2 (MEDIUM) 2.3 (LOW)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26109

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:09 nvd

LOW 2.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages across sibling targets using the same messageId. Attackers can exploit overly broad cache keying to bypass replay protection and deliver duplicate webhook messages to unintended targets.

AnalysisAI

OpenClaw before version 2026.3.31 allows authenticated attackers to bypass webhook replay protection through overly broad cache keying, enabling delivery of duplicate webhook messages to unintended sibling targets when the same messageId is reused. The vulnerability exploits insufficient scope isolation in the webhook replay cache deduplication mechanism, allowing message replay across organizational boundaries within a single authentication context.

Technical ContextAI

OpenClaw's webhook delivery system implements a replay cache to prevent duplicate message delivery, keying deduplication entries by messageId. However, the cache key fails to include sufficient scope isolation (such as target identity, account boundary, or webhook endpoint differentiation), allowing attackers with valid authentication credentials to manipulate which targets receive replayed messages. CWE-706 (Use of Incorrectly-Resolved Name) indicates the root cause involves improper scope resolution in the cache lookup mechanism. The vulnerability affects the webhook processing pipeline, specifically the deduplication logic that should prevent identical messages from being delivered multiple times to the same endpoint but instead allows cross-target message injection when cache entries are reused across sibling targets sharing the same messageId.

RemediationAI

Upgrade OpenClaw to version 2026.3.31 or later; the patch is available via GitHub commit 4d038bb242c11f39e45f6a4bde400e5fd42e4ebf and the associated security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-hhq4-97c2-p447. If immediate patching is not feasible, restrict webhook replay functionality to single-target contexts or disable cross-target message sharing until the patch can be deployed. Monitor webhook delivery logs for duplicate messages to the same target to detect exploitation attempts; if observed, review recent API authentication logs to identify which authenticated users accessed the webhook systems during the delivery window.