CVE-2026-41378: OpenClaw Privilege Escalation Vulnerability

CVE-2026-41378 Overview

CVE-2026-41378 is a privilege escalation vulnerability in OpenClaw versions prior to 2026.3.31 that allows paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. This authorization bypass vulnerability (CWE-862) enables attackers who have already compromised trusted paired node credentials to escalate their privileges by leveraging unrestricted agent.request dispatch, ultimately achieving remote code execution on the gateway.

The vulnerability stems from missing authorization checks in the node event dispatch mechanism, where the gateway fails to properly validate and restrict which tools can be accessed by paired nodes. This creates a trust boundary violation where nodes can invoke powerful gateway-side tools that should be restricted to higher-privilege contexts.

Critical Impact
Attackers with compromised paired node credentials can achieve remote code execution on the OpenClaw gateway by exploiting unrestricted agent request dispatch capabilities, potentially compromising the entire gateway infrastructure.

Affected Products

OpenClaw versions prior to 2026.3.31

Discovery Timeline

2026-04-28 - CVE CVE-2026-41378 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41378

Vulnerability Analysis

This vulnerability represents a Missing Authorization (CWE-862) flaw in OpenClaw's node-to-gateway communication architecture. The core issue lies in how paired nodes with the role=node designation can dispatch agent requests without proper authorization boundaries enforced on the gateway side.

In a properly secured configuration, paired nodes should only have access to a limited subset of gateway tools appropriate for their trust level. However, prior to the patch, the gateway did not implement an allowlist mechanism to restrict which tools could be invoked through node.event agent dispatch. This architectural oversight allowed any authenticated paired node to invoke any available gateway-side tool, including those with high-impact capabilities.

The attack requires the adversary to first obtain valid paired node credentials, making this a post-authentication exploitation scenario. Once authenticated as a paired node, the attacker can leverage the unrestricted tool access to execute arbitrary operations on the gateway, effectively bypassing the intended privilege separation between nodes and the gateway.

Root Cause

The root cause is a missing authorization allowlist for tool access when processing agent requests from paired nodes. The gateway trusted all authenticated nodes equally without implementing granular permission controls based on the message provider type. System events from nodes were also not properly marked as untrusted, allowing them to be processed with full privileges.

Attack Vector

The attack follows a network-based exploitation path requiring low privileges (valid paired node credentials) but no user interaction:

Attacker compromises or obtains credentials for a paired node with role=node
Attacker authenticates to the gateway using the compromised node credentials
Attacker crafts a malicious node.event agent request targeting restricted gateway-side tools
Gateway processes the request without validating tool access permissions
Attacker achieves remote code execution by invoking powerful gateway tools that should be restricted

The security patch introduces a TOOL_ALLOW_BY_MESSAGE_PROVIDER allowlist that explicitly defines which tools are permitted for each message provider type:

typescript

const TOOL_DENY_BY_MESSAGE_PROVIDER: Readonly<Record<string, readonly string[]>> = {
   voice: ["tts"],
 };
+const TOOL_ALLOW_BY_MESSAGE_PROVIDER: Readonly<Record<string, readonly string[]>> = {
+  node: ["canvas", "image", "pdf", "tts", "web_fetch", "web_search"],
+};
const MEMORY_FLUSH_ALLOWED_TOOL_NAMES = new Set(["read", "write"]);

function normalizeMessageProvider(messageProvider?: string): string | undefined {

Source: GitHub Commit Update

Additionally, the patch adds trust boundary markers for system events from nodes:

typescript

   const systemLines: string[] = [];
   const queued = drainSystemEventEntries(params.sessionKey);
   systemLines.push(
-    ...queued
-      .map((event) => {
-        const compacted = compactSystemEvent(event.text);
-        if (!compacted) {
-          return null;
-        }
-        return `[${formatSystemEventTimestamp(event.ts, params.cfg)}] ${compacted}`;
-      })
-      .filter((v): v is string => Boolean(v)),
+    ...queued.flatMap((event) => {
+      const compacted = compactSystemEvent(event.text);
+      if (!compacted) {
+        return [];
+      }
+      const prefix = event.trusted === false ? "System (untrusted)" : "System";
+      const timestamp = `[${formatSystemEventTimestamp(event.ts, params.cfg)}]`;
+      return compacted
+        .split("\n")
+        .map((subline, index) => `${prefix}: ${index === 0 ? `${timestamp} ` : ""}${subline}`);
+    }),
   );

Source: GitHub Commit Update

Detection Methods for CVE-2026-41378

Indicators of Compromise

Unusual agent request patterns from paired nodes attempting to access tools outside the expected allowlist (canvas, image, pdf, tts, web_fetch, web_search)
Gateway logs showing node.event dispatches invoking high-privilege tools that should be restricted
Unexpected tool invocations from node message providers that don't match typical operational patterns
Evidence of system events processed without the "untrusted" flag from node sources

Detection Strategies

Monitor gateway logs for agent.request dispatches originating from role=node paired connections
Implement alerting for any tool invocations from node message providers that fall outside the expected allowlist
Audit paired node authentication events and correlate with subsequent tool access patterns
Review system event processing logs for events lacking proper trust boundary markers

Monitoring Recommendations

Enable detailed logging for all agent request dispatch operations at the gateway level
Implement anomaly detection for paired node behavior, particularly around tool access patterns
Monitor for authentication attempts using node credentials from unexpected network locations
Establish baseline metrics for normal node-to-gateway communication patterns to identify deviations

How to Mitigate CVE-2026-41378

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.31 or later immediately
Audit all existing paired node credentials and rotate any that may have been compromised
Review gateway logs for evidence of exploitation attempts prior to patching
Temporarily restrict network access to the gateway from untrusted network segments if immediate patching is not possible

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.31. The fix implements a tool allowlist mechanism (TOOL_ALLOW_BY_MESSAGE_PROVIDER) that explicitly restricts which gateway-side tools can be accessed by paired nodes. Additionally, the patch adds proper trust boundary markers to system events processed from node sources.

For detailed patch information, refer to:

Workarounds

Implement network segmentation to limit which systems can connect as paired nodes to the gateway
Deploy additional authentication controls such as mutual TLS for paired node connections
Use firewall rules to restrict gateway access to known, trusted node IP addresses
Monitor and alert on all paired node connections until the patch can be applied

bash

# Example: Restrict gateway access at the network level (temporary mitigation)
# Allow only known trusted node IPs to connect to the gateway
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP