Is there a patch available for CVE-2026-41913?

Yes, a patch is available for CVE-2026-41913. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-41913

Q: What is the CVSS score of CVE-2026-41913?

CVE-2026-41913 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26119 MEDIUM

Race Condition (CWE-362)

2026-04-28 VulnCheck

Authentication Bypass Race Condition Openclaw

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Race condition requires concurrent timing precision (AC:H); no prior auth needed to attempt shared-secret bypass (PR:N); impact is limited to rate-limit bypass with low confidentiality exposure and no integrity or availability effect (C:L/I:N/A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:20 vuln.today

Analysis Generated

Jul 24, 2026 - 04:20 vuln.today

Severity Changed

Apr 28, 2026 - 19:52 NVD

LOW MEDIUM

CVSS changed

Apr 28, 2026 - 19:52 NVD

3.7 (LOW) 6.3 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26119

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:10 nvd

MEDIUM 6.3

DescriptionCVE.org

OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per-key rate-limit budget. Attackers can exploit this by sending multiple simultaneous authentication attempts to circumvent intended rate-limiting protections on Tailscale-capable paths.

AnalysisAI

Race condition in OpenClaw's shared-secret authentication subsystem allows unauthenticated network attackers to send concurrent async requests that race the per-key rate-limit budget counter on Tailscale-capable paths, bypassing intended throttling protections. All OpenClaw npm versions prior to 2026.4.4 are affected. No public exploit has been identified and SSVC classifies exploitation as none with partial technical impact; EPSS at 0.04% (12th percentile) reflects minimal real-world exploitation interest.

Technical ContextAI

OpenClaw is a user-controlled local assistant distributed as an npm package (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*). The root cause is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization): the per-key rate-limit budget counter in the shared-secret authentication layer is not atomically updated when concurrent async requests arrive simultaneously, allowing multiple requests to read the budget as non-exhausted before any single request decrements it - a classic TOCTOU pattern on a mutable shared counter. The affected surface is explicitly scoped to Tailscale-capable network paths within the OpenClaw authentication pipeline. The CVSS 4.0 vector (AV:N/AC:H/AT:P) corroborates that exploitation requires network access, high complexity for timing precision, and specific preconditions (AT:P) related to the Tailscale-capable path being reachable.

RemediationAI

Upgrade the openclaw npm package to version 2026.4.4 or later, which contains the verified fix at commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5 (https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5); the vendor confirmed regression tests were added for this security boundary before publication. If an immediate upgrade is not possible, restrict network-level access to Tailscale-capable authentication endpoints using firewall or Tailscale ACL rules to limit the concurrency of inbound auth requests from untrusted sources - this reduces the race window at the cost of potentially throttling legitimate concurrent use. The vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-25wv-8phj-8p7r should be the authoritative reference for any additional guidance.