OpenClaw Authentication Bypass Poses Remote Onboarding Risk

The National Vulnerability Database has detailed CVE-2026-41342, an authentication bypass vulnerability in OpenClaw before version 2026.3.28. This flaw resides within the remote onboarding component, where unauthenticated discovery endpoints persist without requiring explicit trust confirmation. It’s a critical oversight.

Attackers can exploit this by spoofing discovery endpoints, redirecting the onboarding process toward malicious gateways. This allows them to capture gateway credentials or intercept sensitive traffic during the setup phase. The National Vulnerability Database assigns a CVSS score of 7.3 (HIGH) to this vulnerability, underscoring its significant impact potential, particularly for organizations relying on OpenClaw for remote device provisioning.

This vulnerability, categorized under CWE-346 (Improper Handling of Multiple Connections or Sessions), highlights a fundamental trust issue in the onboarding flow. Defenders must recognize that the attacker’s calculus here is to compromise the very first point of contact for new devices or users, establishing a foothold before any security controls are fully operational or trusted. Patching is non-negotiable, and a review of onboarding integrity is paramount.