CVE-2026-41378
Published: 28 April 2026
Summary
CVE-2026-41378 is a high-severity Missing Authorization (CWE-862) vulnerability in Openclaw Openclaw. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 48.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations for node.event agent requests from paired nodes, addressing the missing authorization (CWE-862) that enables privilege escalation.
Applies least privilege to paired nodes with role=node, preventing unrestricted gateway-side tool access and subsequent remote code execution.
Remediates the specific flaw by applying the OpenClaw 2026.3.31 patch that restricts agent.request dispatch.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a privilege escalation flaw (CWE-862) allowing low-privileged paired node credentials to achieve remote code execution on the gateway via unrestricted agent requests, directly mapping to Exploitation for Privilege Escalation (T1068) and Exploitation of Remote Services (T1210).
NVD Description
OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted agent.request dispatch to achieve remote…
more
code execution on the gateway.
Deeper analysisAI
CVE-2026-41378 is a privilege escalation vulnerability affecting OpenClaw versions prior to 2026.3.31. The flaw enables paired nodes assigned the role=node to dispatch node.event agent requests, resulting in unrestricted gateway-side tool access. It is classified under CWE-862 (Missing Authorization) and was published on 2026-04-28.
An attacker with trusted paired node credentials can exploit this vulnerability over the network with low complexity and low privileges required, without user interaction. By leveraging the unrestricted agent.request dispatch, they can escalate privileges to achieve remote code execution on the gateway, with high impacts on confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Mitigation is provided in OpenClaw 2026.3.31. Patch details are available in the GitHub commit at https://github.com/openclaw/openclaw/commit/a77928b1087e90f2a8903f8e5aca6dec9237ac62, along with the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-gjm7-hw8f-73rq and the Vulncheck advisory at https://www.vulncheck.com/advisories/openclaw-privilege-escalation-to-remote-code-execution-via-unrestricted-node-event-agent-dispatch.
Details
- CWE(s)