Junglewise Threat Intelligence

CVE-2026-41342: OpenClaw CLI remote onboarding authentication bypass in gateway discovery

CVE-2026-41342 · Severity: low · CVSS 3.1 · Published 2026-03-31

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is an AI automation platform with a CLI tool used for configuring remote gateway connections. The vulnerability exists in the remote onboarding process, which automatically accepts and saves gateway credentials from discovered endpoints without requiring the user to explicitly verify the authenticity of the endpoint. An attacker who can intercept or manipulate the discovery process could redirect users to a malicious gateway, allowing them to capture authentication credentials and monitor all subsequent communication.

Technical details

The vulnerability is an authentication bypass (CWE-287) and missing authorization check (CWE-862) in the `src/commands/onboard-remote.ts` component. The remote onboarding workflow accepts discovered gateway endpoints without requiring explicit trust confirmation before persisting the remote URL and connection details to the configuration. The attack requires the attacker to be able to influence the discovery endpoint (attack vector: adjacent network), may require user interaction during onboarding, and has no privilege requirements. A successful exploit allows an attacker to capture confidentiality (credentials, traffic) and integrity (modify configuration). The fix was applied in commit d6affb17d8, which adds trust confirmation prompts for discovered remote gateways before saving configuration. Patched versions are available starting from 2026.3.28.

Affected products

  • OpenClaw openclaw <= 2026.3.24

Timeline

  • 2026-03-31: disclosed: Advisory published
  • 2026-03-27: patched: Fix applied in commit d6affb17d8; patched versions >= 2026.3.28

References

Related threats