CVE-2026-41386

Katalog CVE

CVSS 9.8 · Critical EPSS 0,57%

Kerentanan Incorrect Use of Privileged APIs pada openclaw. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope.

Rincian

Terbit di NVD

28 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-648: Incorrect Use of Privileged APIs

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-gg9v-mgcp-v6m7 advisory vendor
• https://github.com/openclaw/openclaw/commit/a600c72ed7d0045a27f58bf031d2b36ecb0141c9 patch
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unbound-bootstrap-setup-codes advisory pihak ketiga