CVE-2026-41300: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41300 is a trust-decline bypass vulnerability in OpenClaw, an npm package, affecting all versions up to and including 2026.3.28. During remote onboarding flows, an attacker-discovered malicious endpoint URL is not cleared when the operator declines the automatic trust prompt; instead, it persists as the pre-filled value in the subsequent manual prompt, potentially routing gateway credentials to an attacker-controlled server. The vulnerability was published on April 21, 2026, and a patch was released in version 2026.3.31. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-372 (Incomplete Internal State Distinction): when an operator declines a discovered remote endpoint during onboarding, the application fails to reset the suggestedUrl state variable to a safe default, allowing the attacker-supplied URL to carry over into the manual configuration prompt. The fix, committed in 2a75416, adds an else branch to the trust-decline path in src/commands/onboard-remote.ts that explicitly resets suggestedUrl to DEFAULT_GATEWAY_URL when trust is declined (GitHub Commit). Exploitation requires no privileges and no special network position, but does require the operator to actively accept the pre-filled malicious URL in the manual prompt (user interaction required). The vulnerability was reported by researcher zsxsoft, sponsored by KeenSecurityLab (GitHub Advisory).

Successful exploitation results in gateway credentials (e.g., WebSocket connection secrets) being transmitted to an attacker-controlled endpoint instead of the legitimate gateway server, resulting in high confidentiality impact. There is no integrity or availability impact — the attacker cannot modify data or disrupt service through this vector alone, but credential theft could enable subsequent unauthorized access to systems protected by those credentials (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an operator to manually accept a pre-filled malicious URL during onboarding, which limits the attack's practicality to social engineering or inattentive operators (GitHub Advisory).

1. Setup malicious endpoint: The attacker establishes a server (e.g., wss://evil.example:443) capable of accepting WebSocket connections and logging any credentials or tokens transmitted to it.
2. Position for discovery: The attacker arranges for their malicious endpoint URL to be returned during the remote onboarding auto-discovery phase — for example, by controlling a network segment, DNS response, or mDNS/discovery service that the OpenClaw CLI queries.
3. Trigger trust decline: The OpenClaw CLI presents the discovered malicious URL to the operator for trust acceptance. The operator, recognizing it as suspicious, declines the automatic trust prompt.
4. Exploit state persistence: Due to the vulnerability, the declined malicious URL is not cleared and instead pre-populates the subsequent manual Gateway WebSocket URL prompt as the initialValue.
5. Operator accepts pre-fill: An inattentive or deceived operator accepts the pre-filled value without noticing it still points to the attacker's server.
6. Credential capture: The OpenClaw CLI connects to the attacker's endpoint and transmits gateway credentials, which the attacker captures for unauthorized access (GitHub Advisory, GitHub Commit).

• Network: Outbound WebSocket connections (wss:// or ws://) from the OpenClaw CLI host to unexpected or external IP addresses/domains during or after the onboarding process; connections to non-standard ports (e.g., 443 for WebSocket rather than the default gateway port 18789).
• Logs: OpenClaw CLI logs showing a gateway URL that differs from the organization's known gateway address; onboarding session logs recording a URL that was previously presented as a discovered (auto-detected) endpoint rather than a manually entered one.
• Configuration: Post-onboarding configuration files containing a gateway WebSocket URL pointing to an unrecognized or external host, particularly one that matches a URL surfaced during the discovery phase.

Upgrade OpenClaw (npm) to version 2026.3.31 or later, which resets the suggestedUrl to DEFAULT_GATEWAY_URL upon trust decline, preventing the malicious endpoint from persisting into the manual prompt (GitHub Commit, GitHub Advisory). As a workaround for environments that cannot immediately upgrade, operators should be instructed to carefully verify and manually clear the pre-filled Gateway WebSocket URL field during onboarding rather than accepting the default value. Restricting network access so that the OpenClaw CLI can only reach known-good gateway addresses at the network level also reduces risk.

The vulnerability was reported by researcher zsxsoft and sponsored by KeenSecurityLab, with the GitHub Security Advisory noting it as a "real shipped onboarding trust-decline bug" assessed at medium severity because operator acceptance of the pre-filled value is still required (GitHub Advisory). No broader media coverage or notable community discussion has been identified beyond the advisory and standard CVE tracking databases.