GHSA-3cw3-5vxw-g2h3

Suggest an improvement
Source
https://github.com/advisories/GHSA-3cw3-5vxw-g2h3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-3cw3-5vxw-g2h3/GHSA-3cw3-5vxw-g2h3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3cw3-5vxw-g2h3
Aliases
  • CVE-2026-41342
Downstream
Published
2026-03-31T23:51:04Z
Modified
2026-05-08T18:33:53.660064Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
  • 7.4 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials
Details

Summary

Remote onboarding accepted discovered gateway endpoints without an explicit trust confirmation before persisting the remote URL and connection details.

Impact

A malicious or spoofed discovery endpoint could steer onboarding toward an attacker-controlled gateway and capture future gateway credentials or traffic.

Affected Component

src/commands/onboard-remote.ts

Fixed Versions

  • Affected: <= 2026.3.24
  • Patched: >= 2026.3.28
  • Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit d6affb17d8 (CLI: confirm discovered remote gateways before saving config).

Database specific 
{
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-287",
        "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-31T23:51:04Z",
    "nvd_published_at": null
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.3.28

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-3cw3-5vxw-g2h3/GHSA-3cw3-5vxw-g2h3.json"
last_known_affected_version_range 
"<= 2026.3.24"