CVE-2026-41393
Openclaw ≤ 2026.3.31
Raw vector
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-41393 is a medium-severity Origin Validation Error (CWE-346) vulnerability in Openclaw Openclaw. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Name Resolution Poisoning and SMB Relay (T1557.001); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-20 (Secure Name/Address Resolution Service (Authoritative Source)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26101
Vulnerability Data
OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-tailnet position and CA-trusted endpoint access can exfiltrate operator credentials through DNS steering manipulation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables DNS authority acceptance and steering manipulation, directly facilitating name resolution poisoning (T1557.001) and credential exfiltration over unencrypted non-C2 protocol (T1048.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation that only authorized authoritative sources are accepted for name/address resolution, directly blocking arbitrary tailnet peers from acting as DNS authorities.
Controls information flows between tailnet peers and enforces policy on which endpoints may supply DNS authority data, preventing steering manipulation.
Enforces access decisions so that only explicitly authorized peers may be treated as DNS authorities or supply credentials via DNS responses.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Authentication directly verifies the source of users/services/hardware, mitigating origin validation failures.
Verifying identity assertions enforces origin validation for conveyed claims.
Documenting authorized flows supports origin validation by defining expected sources.
Protecting networks from unauthorized access requires origin checks on communication sources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls enforce origin validation at network boundaries.
Security of network services includes validating the authenticity of service endpoints.
Network segregation reduces exposure but does not directly validate origins.
Application security requirements explicitly call for origin validation of inputs and communications.
Secure architecture principles encourage origin checks but do not mandate them.
Secure coding practices include implementing proper origin validation to prevent spoofing.