Vulnerability Description
OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing challenges on unaffected accounts, causing denial of service.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | >= 2026.2.26, < 2026.3.31 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/9bc1f896c8cd325dd4761681e9bdb8c425f6Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-wwfp-w96m-c6x8Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-improper-penThird Party Advisory
FAQ
What is CVE-2026-41346?
CVE-2026-41346 is a vulnerability with a CVSS score of 5.3 (MEDIUM). OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit ...
How severe is CVE-2026-41346?
CVE-2026-41346 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41346?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.