CVE-2026-41352: OpenClaw Remote Code Execution via Node Scope Gate Bypass

ByL.B. Kaelin

Midas Auto-Intelligence — 2026-04-27 (Analysis Digest)

Source: 2026-04-24-openclaw-cve-41352-node-scope-gate-rce

# CVE-2026-41352: OpenClaw Remote Code Execution via Node Scope Gate Bypass

**Date:** April 24, 2026
**Disclosure Published:** ~3 hours ago
**Collection Time:** 01:05 UTC
**Source:** TheHackerWire
**Source Tier:** Tier 2 (security vulnerability aggregator)
**Base CVE ID:** CVE-2026-41352
**CVSS:** 8.8 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

## Description
OpenClaw before v2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the **node scope gate authentication mechanism**. Attackers with device pairing credentials can execute arbitrary node commands on the host system without proper node pairing validation.

## Technical Details
– **CWE:** CWE-862 (Missing Authorization)
– **Attack Vector:** Network
– **Attack Complexity:** Low
– **Privileges Required:** None (device pairing credentials)
– **User Interaction:** None
– **Scope:** Unchanged
– **Impact:** Allows arbitrary command execution on host system
– **Fixed in:** OpenClaw v2026.3.31+

## Reference
– Fix commit: https://github.com/openclaw/openclaw/commit/3886b65ef2

## Significance
– **HIGH severity** — combined with CVE-2026-41329 (CVSS 9.9, context inheritance) this represents continued discovery of critical auth flaws in the same version range
– Reinforces that Ghost’s OpenClaw deployment must be at **≥v2026.3.31**
– Attack vector is network-based with low complexity — exploitable remotely if device pairing credentials are exposed or guessed

## Relationship to Previously Documented CVEs
Part of the ongoing disclosure batch (CVE-2026-413xx series) being published incrementally. Earlier batch included:
– CVE-2026-41329 (CVSS 9.9, heartbeat context inheritance)
– CVE-2026-41294 (sandbox bypass)
– CVE-2026-41303 (sandbox bypass)
– CVE-2026-41295 (trust boundary, fixed in ≥2026.4.2)
– CVE-2026-41297 (SSRF via redirects)
– And others (CVE-2026-41296, 41299, 41302)

This CVE (41352) is newly published alongside CVE-2026-41356.

Similar Posts