Vulnerability Description
OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly identified as local loopback traffic, circumventing intended remote viewer restrictions.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.3.31 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/30a1690323088fd291abd11643a264a6828aPatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4rVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-access-control-bypass-via-proxied-Third Party Advisory
FAQ
What is CVE-2026-41403?
CVE-2026-41403 is a vulnerability with a CVSS score of 2.9 (LOW). OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass acces...
How severe is CVE-2026-41403?
CVE-2026-41403 has been rated LOW with a CVSS base score of 2.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41403?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.