{"action":"Upgrade openclaw to 2026.3.31 or later.","affected":[{"fixed":"2026.3.31","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-41406"],"ecosystem":"npm","epss":0.00222,"exploited":false,"fixed_versions":["2026.3.31"],"ghsa_id":"GHSA-877v-w3f5-3pcq","id":"tcs_01M5KFC36CE618N063JP9075XY","modified_at":"2026-05-06T02:51:12.597097Z","published_at":"2026-04-02T20:59:49Z","references":["https://osv.dev/vulnerability/GHSA-877v-w3f5-3pcq","https://github.com/openclaw/openclaw/security/advisories/GHSA-877v-w3f5-3pcq","https://nvd.nist.gov/vuln/detail/CVE-2026-41406","https://github.com/openclaw/openclaw/commit/f45e5a6569aab1d58cc6de25b19f1dc4c8779b85","https://github.com/openclaw/openclaw","https://github.com/openclaw/openclaw/releases/tag/v2026.3.31","https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-thread-history-and-quoted-messages"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-877v-w3f5-3pcq","url":"https://osv.dev/vulnerability/GHSA-877v-w3f5-3pcq"}],"summary":"OpenClaw: Feishu thread history and quoted messages bypass sender allowlist"}