CVE-2026-41910: OpenClaw Auth Bypass Vulnerability

CVE-2026-41910 Overview

CVE-2026-41910 is an authorization bypass vulnerability in OpenClaw before version 2026.4.8. The vulnerability stems from missing owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An authorized non-owner sender can bypass access controls to perform allowlist modifications against different channels, violating the intended trust model. This represents a broken access control flaw classified under CWE-863 (Incorrect Authorization).

Critical Impact
Authenticated users can modify allowlists for channels they do not own, enabling unauthorized cross-channel configuration changes that undermine the application's trust boundaries.

Affected Products

OpenClaw versions prior to 2026.4.8

Discovery Timeline

2026-04-28 - CVE CVE-2026-41910 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41910

Vulnerability Analysis

This vulnerability is classified as an Authorization Bypass (CWE-863: Incorrect Authorization). The flaw exists in OpenClaw's /allowlist endpoint, which fails to properly validate that the requesting user is the owner of the target channel before permitting allowlist write operations.

In a properly secured implementation, allowlist modifications should only be permitted by the channel owner. However, the vulnerable versions of OpenClaw omit this critical ownership check during cross-channel operations. This means any authenticated user with write permissions to their own channel can craft requests targeting other channels' allowlists.

The attack requires network access and an authenticated session with low privileges. The primary impact is to data integrity, as attackers can manipulate allowlist configurations for channels they should not control. While confidentiality and availability are not directly affected, unauthorized allowlist modifications can have cascading effects on the trust model the application was designed to enforce.

Root Cause

The root cause is missing authorization logic in the /allowlist endpoint handler. The code path for processing cross-channel allowlist write requests does not verify channel ownership before executing the modification. This represents an incomplete implementation of the principle of least privilege, where the system grants more access than necessary to authenticated users.

Attack Vector

The attack exploits the network-accessible /allowlist endpoint. An attacker must first authenticate to the OpenClaw application with valid credentials, establishing a legitimate session. Once authenticated, the attacker can submit allowlist modification requests that specify a target channel different from their own. Because the vulnerable code does not enforce owner-only restrictions on these cross-channel writes, the modifications are processed successfully.

The attack scenario involves:

Attacker authenticates as a legitimate but non-owner user
Attacker identifies target channels owned by other users
Attacker submits allowlist write requests targeting those channels
Server processes the requests without ownership validation
Allowlist modifications are applied, violating access control policies

The security patch addresses this by restructuring the DNS pinning and proxy dispatch logic to ensure proper enforcement occurs before proceeding with operations:

typescript

     try {
       assertExplicitProxySupportsPinnedDns(parsedUrl, params.dispatcherPolicy, params.pinDns);
       await assertExplicitProxyAllowed(params.dispatcherPolicy, params.lookupFn, params.policy);
-      const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
-        lookupFn: params.lookupFn,
-        policy: params.policy,
-      });
       const canUseTrustedEnvProxy =
         mode === GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY && hasProxyEnvConfigured();
       if (canUseTrustedEnvProxy) {
         dispatcher = createHttp1EnvHttpProxyAgent();
       } else if (params.pinDns === false) {
         dispatcher = createPolicyDispatcherWithoutPinnedDns(params.dispatcherPolicy);
       } else {
+        const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+          lookupFn: params.lookupFn,
+          policy: params.policy,
+        });
         dispatcher = createPinnedDispatcher(pinned, params.dispatcherPolicy, params.policy);
       }

Source: GitHub Commit Update

Detection Methods for CVE-2026-41910

Indicators of Compromise

Unexpected allowlist modifications on channels where the authenticated user is not the owner
API access logs showing /allowlist endpoint calls with channel IDs not associated with the requesting user
Audit trail entries indicating cross-channel configuration changes by non-owner accounts

Detection Strategies

Implement logging for all /allowlist endpoint requests that captures both the requesting user and target channel ownership
Create alerting rules for allowlist modifications where the authenticated user does not match the channel owner
Deploy API gateway monitoring to detect unusual patterns of cross-channel write attempts

Monitoring Recommendations

Enable detailed audit logging for all allowlist operations in OpenClaw
Monitor for elevated rates of authorization failures or unusual API request patterns
Review access logs periodically for cross-channel write attempts that may indicate exploitation attempts or misconfigurations

How to Mitigate CVE-2026-41910

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.8 or later immediately
Review audit logs for any historical cross-channel allowlist modifications by non-owner accounts
Validate current allowlist configurations across all channels for unauthorized changes

Patch Information

The vulnerability is addressed in OpenClaw version 2026.4.8. The fix is available via commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5. Organizations should upgrade to the patched version as soon as possible. Additional details are available in the GitHub Security Advisory GHSA-vc32-h5mq-453v and the VulnCheck Advisory on OpenClaw.

Workarounds

Implement additional access control at the network or API gateway layer to restrict /allowlist endpoint access pending upgrade
Consider temporarily disabling cross-channel allowlist functionality if business operations permit
Deploy Web Application Firewall (WAF) rules to monitor and potentially block suspicious /allowlist requests targeting channels not owned by the requester

bash

# Configuration example
# Restrict access to /allowlist endpoint at reverse proxy level
# Example nginx configuration to limit access while awaiting patch
location /allowlist {
    # Limit to internal networks only as temporary measure
    allow 10.0.0.0/8;
    deny all;
}