OpenClaw RCE: Paired Nodes Bypass Auth, Allow Arbitrary Commands

The National Vulnerability Database has disclosed CVE-2026-41352, a high-severity remote code execution (RCE) vulnerability impacting OpenClaw before version 2026.3.31. This flaw, rated 8.8 CVSS, allows attackers with existing device pairing credentials to execute arbitrary node commands on the host system. The core issue is a bypass of the node scope gate authentication mechanism.

This isn’t a zero-day requiring initial access; it’s a critical privilege escalation. An attacker who has already compromised or legitimately obtained device pairing credentials can leverage this vulnerability to move laterally and gain full control without further node pairing validation. The National Vulnerability Database attributes this to CWE-862, a missing authorization vulnerability.

For defenders, this means the attack surface isn’t just external; it’s also internal, targeting trusted relationships. Any system relying on OpenClaw for device-paired node operations needs immediate attention. The attacker’s calculus is straightforward: get a foothold, then exploit this to own the system. It’s a clear path from limited access to full compromise.