What’s Vulnerable › Vulnerabilities

CVE-2026-41378: OpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-28 · updated 2026-06-17
• Weakness: CWE-862

Description

OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted agent.request dispatch to achieve remote code execution on the gateway.

Affected products

• OpenClaw: before 2026.3.31 — fixed in 2026.3.31

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.31. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/a77928b1087e90f2a8903f8e5aca6dec9237ac62
• https://github.com/openclaw/openclaw/security/advisories/GHSA-gjm7-hw8f-73rq
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-to-remote-code-execution-via-unrestricted-node-event-agent-dispatch

Get alerted when CVE-2026-41378 or the next vulnerability affects your stack