CVE-2026-41406

5.4 Moyenne

Publiée le 28/04/2026 à 21:37 · Modifiée le 17/06/2026 à 12:46 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fetched quoted, root, and thread context messages to bypass sender allowlist restrictions and retrieve unauthorized content.

Traduire en français

Produits concernés

OpenClaw
Openclaw openclaw

Scores CVSS

Version	Score	Source	Vecteur
4.0	2.3 Faible	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.4 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-639

Références

https://github.com/openclaw/openclaw/commit/f45e5a6569aab1d58cc6de25b19f1dc4c8779b85 Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-877v-w3f5-3pcq Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-thread-history-and-quoted-messages Third Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories