CVE-2026-41377 Details
Description
OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings.
A fail-open vulnerability has been identified in OpenClaw versions prior to 2026.3.31. This vulnerability occurs in the plugin installation process, where security scan failures do not prevent the installation of untrusted plugins. As a result, operators can inadvertently install potentially harmful plugins by ignoring visible scan warnings. The issue arises because the system allows installations to proceed despite critical security findings, creating a risk of executing malicious code or actions through the installed plugins.
Users can update to OpenClaw version 2026.3.31 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-636 | Not Failing Securely ('Failing Open') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.3.31 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 28, 2026 | New CVE Received | [email protected] |