CVE-2026-41352 is a high-severity vulnerability in the openclaw npm package where a device-paired node can bypass the node scope gate, potentially allowing remote code execution on the host. Versions up to 2026.3.28 are affected. The issue is fixed in version 2026.3.31.