CVE-2026-41403

Katalog CVE

CVSS 4.0 · Medium EPSS 0,37%

Kerentanan Reliance on Untrusted Inputs in a Security Decision pada openclaw. Skor CVSS 3.1 4.0 (Medium) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly identified as local loopback traffic, circumventing intended remote viewer restrictions.

Rincian

Terbit di NVD

28 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.0 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4r advisory vendor
• https://github.com/openclaw/openclaw/commit/30a1690323088fd291abd11643a264a6828a002c patch
• https://www.vulncheck.com/advisories/openclaw-access-control-bypass-via-proxied-remote-request-misclassificati... advisory pihak ketiga