CVE-2026-41300 is a trust-decline vulnerability affecting OpenClaw versions prior to 2026.3.31. The flaw allows malicious endpoints discovered during remote onboarding flows to persist through the trust decline process, enabling attackers to redirect gateway credentials to attacker-controlled servers by manipulating manual operator prompts. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring no privileges but user interaction. The primary impact is confidentiality loss through credential exposure, though integrity and availability are not affected. The low EPSS score of 0.00029 indicates minimal prevalence compared to other CVEs. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows no active exploitation in the wild. The Hot List status is inactive, suggesting limited community attention and no publicly available exploit code at this time. Organizations running OpenClaw should prioritize upgrading to version 2026.3.31 or later as a preventive measure.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, < 2026.3.31CPE match | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* | ||
< 2026.3.31CPE matchmatch criteria | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.