CVE-2026-41335

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Control UI bootstrap payload to identify system versions and agent configurations.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published
Apr 23, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-413367.8OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling loading of aCVE-2026-413375.3OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-prCVE-2026-413385.0OpenClaw before 2026.3.31 contains a time-of-check-time-of-use vulnerability in sandbox file operations that allows attackers to bypass fd-bCVE-2026-413394.3OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. NCVE-2026-41347.3During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could alloCVE-2026-413406.5OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where Telegram legacy allowFrom migration incorrectly fans defauCVE-2026-413415.4OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as directCVE-2026-413428.1OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated dCVE-2026-413435.3OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient CVE-2026-413448.8OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers tCVE-2026-413455.3OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers aCVE-2026-413467.5OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exh
CVE-2026-41335: Medium severity, CVSS 5.3 | Vulnix