Which versions of OpenClaw are affected by CVE-2026-41404?

CVE-2026-41404 is a privilege escalation vulnerability in OpenClaw's trusted-proxy authentication that allows authenticated users to escalate from low-privilege accounts to full administrative access…. A patch is available.

How to fix or mitigate CVE-2026-41404?

Within 24 hours: inventory all OpenClaw deployments and identify instances running in trusted-proxy authentication mode; assess current version against 2026.3.31. Within 7 days: apply vendor patch to version 2026.3.31 or later across all affected OpenClaw instances; validate patch deployment and restart services. Within 30 days: conduct access reviews for low-privileged authenticated accounts; audit administrative action logs for the past 90 days to detect potential exploitation.

OpenClaw CVE-2026-41404

Q: What is the CVSS score of CVE-2026-41404?

CVE-2026-41404 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-26111 HIGH

Incorrect Authorization (CWE-863)

2026-04-28 VulnCheck

GHSA-g374-mggx-p6xc

Authentication Bypass Privilege Escalation Openclaw

7.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:23 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 20:05 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

8.8 (HIGH) 7.7 (HIGH)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26111

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:10 nvd

HIGH 7.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can exploit this by declaring operator scopes on non-Control-UI clients, allowing self-declared scopes to persist on identity-bearing authentication paths and escalate privileges.

AnalysisAI

Privilege escalation in OpenClaw's trusted-proxy authentication mode allows low-privileged authenticated users to gain operator.admin privileges by declaring operator scopes on non-Control-UI clients. The incomplete scope-clearing mechanism fails to sanitize self-declared scopes when identity-bearing authentication paths process requests, enabling attackers to bypass authorization checks and achieve full administrative access. Vendor patch available via commit 8b88b927 in version 2026.3.31; no confirmed active exploitation (not in CISA KEV) but publicly disclosed with detailed GitHub security advisory increasing attack feasibility.

Technical ContextAI

This vulnerability affects the trusted-proxy authentication architecture in OpenClaw, where the application delegates authentication to an upstream proxy or reverse proxy server. The root cause is CWE-863 (Incorrect Authorization), specifically an incomplete implementation of scope validation during authentication context transitions. In trusted-proxy mode, OpenClaw receives authenticated identity claims from the proxy but fails to properly sanitize or validate operator scope declarations when processing requests from clients that are not part of the Control-UI interface. The incomplete scope-clearing allows attacker-controlled scope assertions to persist across authentication boundaries, bypassing the intended privilege separation model. This represents a critical failure in the security boundary between the trusted proxy layer and the application's authorization logic, where scope inheritance or propagation mechanisms do not properly distinguish between trusted Control-UI assertions and untrusted client-originated scope claims.

RemediationAI

Upgrade to OpenClaw version 2026.3.31 or later, which contains the complete fix implemented in commit 8b88b927cb0747ad24d95b07d35682bf85dc5b0e (https://github.com/openclaw/openclaw/commit/8b88b927cb0747ad24d95b07d35682bf85dc5b0e). Organizations unable to immediately upgrade should disable trusted-proxy authentication mode and migrate to native authentication mechanisms, though this requires reconfiguring authentication flows and may impact SSO integrations. As a temporary mitigation, implement strict network segmentation to limit access to OpenClaw's authentication endpoints to only trusted proxy sources, though this does not prevent exploitation by authenticated insiders. Review audit logs for suspicious operator.admin privilege usage or scope declaration patterns from non-Control-UI clients, focusing on authentication events showing privilege escalation without corresponding Control-UI session context. Do not rely solely on downstream authorization checks, as the vulnerability compromises the core authorization model.