PT-2026-33866 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-31 · Updated 2026-04-27 · CVE-2026-41299

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description An authorization bypass exists in the 'chat.send' gateway method. The issue occurs because ACP-only provenance fields are gated by self-declared client metadata from the WebSocket handshake instead of a verified authorization state. This allows authenticated operator clients to spoof ACP identity labels and inject reserved provenance fields intended exclusively for the ACP bridge by manipulating client metadata during the connection process.

Recommendations Update to version 2026.3.28.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-807

CWE-290

Related Identifiers

CVE-2026-41299

GHSA-6XG4-82HV-CP6F

Affected Products

Openclaw

References · 10

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6xg4-82hv-cp6f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6xg4-82hv-cp6f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41299 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/4b9542716c26ac77652bcaa0f562043b298b409f · Note
• https://t.me/cveNotify/161116 · Telegram Post
• https://twitter.com/CVEnew/status/2046571879851553072 · Twitter Post
• https://twitter.com/pulsepatchio/status/2046426210612183047 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046459218761302238 · Twitter Post
• https://vulncheck.com/advisories/openclaw-client-identity-spoofing-in-chat-send-gateway-provenance-guard · Note