OpenClaw versions up to 2026.3.28 have a vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime scopes, potentially allowing elevated privileges within plugin routes. This issue is limited to plugin routes that interact with privileged runtime actions before plugin authentication completes. The vulnerability has been assigned CVE-2026-41394 and is rated high severity with a CVSS score of 8.2. A fix is available in version 2026.3.31 and later.