Cyber Resilience

CVE-2026-41407

Openclaw ≤ 2026.4.2

Public PoC
Published
28 April 2026
Modified
30 April 2026
Patch / advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0022 13th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-41407 is a medium-severity Observable Timing Discrepancy (CWE-208) vulnerability in Openclaw Openclaw. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Weaken Encryption (T1600); ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

OpenClaw before 2026.4.2 contains a timing side channel vulnerability in shared-secret comparison call sites that use early length-mismatch checks instead of fixed-length comparison helpers. Attackers can measure timing differences to leak secret-length information, weakening constant-time handling for shared secrets.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1600 Weaken Encryption Defense Impairment
Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.
Why these techniques?

Timing side-channel in shared-secret comparison directly weakens constant-time crypto protections, enabling key/secret information leakage that reduces effective security (T1600).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-28475Same product: Openclaw Openclaw
CVE-2026-28464Same product: Openclaw Openclaw
CVE-2026-28463Same product: Openclaw Openclaw
CVE-2026-41408Same product: Openclaw Openclaw
CVE-2026-32923Same product: Openclaw Openclaw
CVE-2026-32021Same product: Openclaw Openclaw
CVE-2026-41296Same product: Openclaw Openclaw
CVE-2026-32063Same product: Openclaw Openclaw
CVE-2026-43576Same product: Openclaw Openclaw
CVE-2026-35637Same product: Openclaw Openclaw

Affected Assets

openclaw
openclaw
≤ 2026.4.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SA-8 Security and Privacy Engineering Principles
  • SA-11 Developer Testing and Evaluation
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V11.2.4

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires engineering principles that mandate constant-time implementations and avoidance of early-exit comparisons in shared-secret handling.

prevent

Requires developer testing and evaluation specifically capable of detecting timing side-channel leaks in cryptographic comparison routines.

prevent

Mandates timely application of patches that replace vulnerable early length-mismatch checks with fixed-length constant-time helpers.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require constant-time implementations that eliminate observable timing discrepancies.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

none

Consistent reference clocks limit the attacker's ability to measure or manipulate timing differences that could reveal internal state or processing paths.

References