CVE-2026-41394:

OpenClaw before 2026.3.31 contains an authentication bypass vulnerability (CWE-862) that allows unauthenticated users to access plugin-auth HTTP routes with operator runtime write scopes, enabling unauthorized privileged actions.

OpenClaw before 2026.3.31 suffers from a missing authorization flaw in its plugin-auth HTTP route handling. These routes, which are accessible without authentication, are improperly scoped with operator-level runtime write permissions. As a result, any unauthenticated network-accessible attacker can invoke privileged runtime actions that should be restricted to authenticated operators. The attack requires no prior access, no user interaction, and no complex preconditions, making it trivially exploitable from any network location with access to the OpenClaw service. The primary risk is unauthorized modification of runtime state with a secondary risk of limited information disclosure.