Vulnerability Report

CVE-2026-41377

Title: Fail-Open Plugin Installation Allows Untrusted Plugins

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-41377.

CWE Category CWE-636

Published Date Apr 28, 2026

Modified Date May 01, 2026

Exploit Status Not Found

Score 5.1 CVSS v4.0

Exploit Probability (EPSS)

0.23%

Vulnerability Summary

CVE-2026-41377: OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings.

Impacted Vendors

openclaw 1

Reference Links

https://github.com/openclaw/openclaw/commit/0d7f1e2c84eca65df7dee890d9c30e2a841c030a https://github.com/openclaw/openclaw/commit/44b993613601280d46a5b88190e46669fc13d669 https://github.com/openclaw/openclaw/commit/7a953a52271b9188a5fa830739a4366614ff9916 https://github.com/openclaw/openclaw/commit/bf96c67fd1954740aeabfadc7cfe3098bcfc6b68 https://github.com/openclaw/openclaw/security/advisories/GHSA-cwq8-6f96-g3q4 https://www.vulncheck.com/advisories/openclaw-fail-open-security-scan-bypass-in-plugin-installation

CVSS v4.0

Source Entity [email protected]

Severity MEDIUM

5.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

PASSIVE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

4.6

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-41377 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

May 01, 2026 MODIFIED

Vulnerability data updated via NVD.

April 28, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction PASSIVE

CVSS Vector String


                                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Stack

No specific products linked.