CVE-2026-41403: OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification

Severity: medium (CVSS 4.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-28 · updated 2026-06-17
Weakness: CWE-807

Description

OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly identified as local loopback traffic, circumventing intended remote viewer restrictions.

Affected products

OpenClaw: before 2026.3.31 — fixed in 2026.3.31

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.31. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/30a1690323088fd291abd11643a264a6828a002c
https://github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4r
https://www.vulncheck.com/advisories/openclaw-access-control-bypass-via-proxied-remote-request-misclassification

Get alerted when CVE-2026-41403 or the next vulnerability affects your stack