CVE-2026-41346
Openclaw 2026.2.26 – 2026.3.31
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-41346 is a medium-severity Improper Control of Interaction Frequency (CWE-799) vulnerability in Openclaw Openclaw. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and AC-7 (Unsuccessful Logon Attempts) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-41346 affects OpenClaw versions 2026.2.26 before 2026.3.31. The vulnerability stems from the application enforces pending pairing-request caps per channel file rather than per account, which allows attackers to exhaust the shared pending window. Published on 2026-04-23, it is rated with a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and is associated with CWE-799 (Improper Control of Interaction Frequency).
Remote attackers with no privileges required can exploit this issue by submitting pairing requests from other accounts. This action blocks new pairing challenges on unaffected accounts, resulting in a denial of service that prevents legitimate pairing operations.
Advisories and patches are detailed in referenced sources, including a GitHub commit (9bc1f896c8cd325dd4761681e9bdb8c425f69785) that addresses the flaw, the OpenClaw security advisory (GHSA-wwfp-w96m-c6x8), and a VulnCheck advisory on the denial-of-service via improper pending pairing request cap enforcement. Upgrading to OpenClaw 2026.3.31 or later resolves the issue by enforcing caps per account.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25330
Vulnerability Data
OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing challenges on unaffected accounts,…
more
causing denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
ac-10 enforces a hard limit on concurrent sessions per user, directly stopping uncontrolled interaction frequency at the session level.
ac-7 directly enforces a limit on the frequency of invalid authentication attempts, structurally preventing the weakness for that interaction class.
sc-5 reduces the impact of excessive request volume (DoS) but does not itself impose the frequency controls whose absence defines the weakness.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Protecting networks from unauthorized usage can incorporate rate limiting to bound interaction frequency.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls can enforce rate limiting and throttling at the perimeter.
Application security requirements explicitly include controls on interaction frequency and throttling.
Secure architecture principles recommend rate-limiting and resource-management mechanisms.
Secure coding practices can embed input-frequency and throttling checks in code.
Capacity management directly limits request rates and resource exhaustion that CWE-799 describes.