The vulnerability permits an attacker who shares the same tailnet with a target system to add an arbitrary peer as a DNS authority. Once accepted, the compromised peer can manipulate DNS steering to redirect traffic, thereby enabling the exfiltration of operator credentials. This weakness allows credential theft while the adversary remains within the trusted network boundary, representing a medium risk of sensitive data exposure.

OpenClaw OpenClaw running on node.js is affected when the version is older than 2026.3.31. Systems using the 2026.3.30 release or earlier are vulnerable. No other products or versions are currently listed as impacted.

The CVSS base score of 5.9 indicates moderate severity. Because the EPSS score is not available, the historical exploitation likelihood cannot be quantified; however, the vulnerability was noted by the community without reports of active exploitation. The attack requires the attacker to be positioned on the same tailnet and to control a CA‑trusted endpoint, meaning it is an internal threat that relies on privileged network access. The risk is heightened for environments where tailnet peers are broadly allowed to act as DNS authorities. The vulnerability is not listed in the CISA KEV catalog at this time.