GitHub Advisoryadvisory · npm

GHSA-mhgq-xpfq-6r66 OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

MEDIUM Published 2026-04-02 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-41394
Ecosystem
npm
Packages
openclaw
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Weaknesses
CWE-269, CWE-862
Reviewed
2026-04-02

Affected packages

• npm openclaw: < 2026.3.31 → fixed in 2026.3.31

Description

Summary Unauthenticated plugin-auth HTTP routes receive operator runtime scopes Current Maintainer Triage • Status: narrow • Normalized severity: medium • Assessment: v2026.3.28 still gives auth:"plugin" routes operator WRITE_SCOPE, but impact should stay limited to plugin routes that actually touch privileged runtime actions before plugin auth completes. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published npm version: `2026.3.31` • Vulnerable version range: `= 2026.3.31` • First stable tag containing the fix: `v2026.3.31` Fix Commit(s) • `2a1db0c0f1fa375004a95ba0ef030534790a6d47` — 2026-04-01T00:20:49+09:00 OpenClaw thanks @davidluzsilva for reporting.

Related

Alias · CVE (1)

  • CVE-2026-41394 OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator… vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-862 Missing Authorization weakness

References