GitHub Advisoryadvisory · npm

GHSA-3cw3-5vxw-g2h3 OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

HIGH Published 2026-03-31 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-41342
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-287, CWE-862
Reviewed
2026-03-31

Affected packages

• npm openclaw: < 2026.3.28 → fixed in 2026.3.28

Description

Summary Remote onboarding accepted discovered gateway endpoints without an explicit trust confirmation before persisting the remote URL and connection details. Impact A malicious or spoofed discovery endpoint could steer onboarding toward an attacker-controlled gateway and capture future gateway credentials or traffic. Affected Component `src/commands/onboard-remote.ts` Fixed Versions • Affected: `= 2026.3.28` • Latest stable `2026.3.28` contains the fix. Fix Fixed by commit `d6affb17d8` (`CLI: confirm discovered remote gateways before saving config`).

Related

Alias · CVE (1)

  • CVE-2026-41342 OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-862 Missing Authorization weakness

References