CVE-2026-41300: Openclaw

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote onboarding flows. Attackers can route gateway credentials to malicious endpoints by having their discovered URL survive the trust decline process into manual prompts requiring operator acceptance.

Affected products

• Openclaw Openclaw: before 2026.3.31 (fixed in 2026.3.31)

Published 2026-04-21. Last modified 2026-06-17.