{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/remote-onboarding/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-41342"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["openclaw"],"_cs_severities":["high"],"_cs_tags":["authentication bypass","remote onboarding","credential theft","cve-2026-41342"],"_cs_type":"advisory","_cs_vendors":["openclaw"],"content_html":"\u003cp\u003eOpenClaw, a software solution, is vulnerable to an authentication bypass flaw in versions prior to 2026.3.28. Specifically, the remote onboarding component persists unauthenticated discovery endpoints without requiring explicit trust confirmation. This vulnerability, identified as CVE-2026-41342, enables a threat actor to spoof legitimate discovery endpoints. By doing so, attackers can redirect the onboarding process toward malicious gateways under their control. This redirection allows the attacker to intercept and capture gateway credentials or monitor sensitive network traffic. This is a critical vulnerability because successful exploitation allows an attacker to gain unauthorized access to a target system and potentially escalate privileges.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a vulnerable OpenClaw instance running a version before 2026.3.28.\u003c/li\u003e\n\u003cli\u003eThe attacker spoofs a legitimate discovery endpoint using a malicious server.\u003c/li\u003e\n\u003cli\u003eA new or existing user attempts to onboard remotely through the OpenClaw application.\u003c/li\u003e\n\u003cli\u003eThe application, lacking proper authentication checks, connects to the attacker's spoofed discovery endpoint.\u003c/li\u003e\n\u003cli\u003eThe spoofed endpoint redirects the onboarding process to a malicious gateway controlled by the attacker.\u003c/li\u003e\n\u003cli\u003eThe user unknowingly provides their gateway credentials to the malicious gateway.\u003c/li\u003e\n\u003cli\u003eThe attacker captures the user's gateway credentials or intercepts subsequent network traffic.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the stolen credentials to gain unauthorized access to the OpenClaw system or other related resources.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-41342 can lead to credential compromise and unauthorized access to sensitive systems and data. An attacker who successfully spoofs a discovery endpoint can steal gateway credentials, enabling them to impersonate legitimate users and perform malicious actions within the OpenClaw environment. The impact is significant for organizations relying on OpenClaw for secure remote onboarding, potentially leading to data breaches, service disruption, and reputational damage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenClaw to version 2026.3.28 or later to patch CVE-2026-41342 and mitigate the authentication bypass vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement network monitoring to detect and alert on connections to unexpected or untrusted discovery endpoints. Consider deploying a network connection rule like the one below to detect suspicious connections during onboarding.\u003c/li\u003e\n\u003cli\u003eReview and strengthen the onboarding process to include multi-factor authentication and explicit trust confirmation for discovery endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-24-openclaw-auth-bypass/","summary":"OpenClaw before 2026.3.28 contains an authentication bypass vulnerability (CVE-2026-41342) in the remote onboarding component, allowing attackers to spoof discovery endpoints and capture gateway credentials or traffic.","title":"OpenClaw Authentication Bypass in Remote Onboarding","url":"https://feed.craftedsignal.io/briefs/2026-04-24-openclaw-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Remote Onboarding","version":"https://jsonfeed.org/version/1.1"}