CVE-2026-41346

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41346
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41346.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41346
Aliases
Downstream
Published
2026-04-23T21:58:05.227Z
Modified
2026-07-15T01:49:06.364039630Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcement
Details

OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing challenges on unaffected accounts, causing denial of service.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41346.json",
    "cwe_ids": [
        "CWE-799"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/openclaw/openclaw

Affected ranges

Type
GIT
Repo
https://github.com/openclaw/openclaw
Events
Introduced
bc507080577c620243617e8fadd294bec3efa252
Fixed
213a704b71f4996dc82a583288ee53785215f627
Fixed
9bc1f896c8cd325dd4761681e9bdb8c425f69785
Database specific 
{
    "cpe": "cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2026.2.26"
        },
        {
            "fixed": "2026.3.31"
        }
    ]
}

Affected versions

v2026.*
v2026.2.26
v2026.3.1
v2026.3.11
v2026.3.11-beta.1
v2026.3.12
v2026.3.13
v2026.3.13-1
v2026.3.2
v2026.3.2-beta.1
v2026.3.22
v2026.3.22-beta.1
v2026.3.23
v2026.3.23-2
v2026.3.23-beta.1
v2026.3.24
v2026.3.24-beta.1
v2026.3.24-beta.2
v2026.3.28
v2026.3.28-beta.1
v2026.3.31-beta.1
v2026.3.7
v2026.3.7-beta.1
v2026.3.8
v2026.3.8-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41346.json"