CVE-2026-41377 is a vulnerability in the OpenClaw npm package where a security scan failure does not block plugin installation, resulting in a fail-open condition. This issue affects versions up to 2026.3.28 and was fixed in version 2026.3.31. The vulnerability requires user interaction to install an untrusted plugin despite the scan failure being visible. The severity is rated medium with a CVSS score of 4.6.