PT-2026-34790 · Openclaw · Openclaw

Peng Zhou · Published 2026-04-07 · Updated 2026-04-25 · CVE-2026-41359

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description Insufficient access controls allow authenticated operators with write permissions to perform privilege escalation. By utilizing the 'send' endpoint, attackers with operator.write credentials can access administrative Telegram configuration and cron persistence settings, enabling the modification of persistence mechanisms.

Recommendations Update to version 2026.3.28 or later. Restrict access to the 'send' endpoint for users with operator permissions until the update is applied.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-41359

GHSA-394X-274P-MQC6

GHSA-767M-XRHC-FXM7

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/b7d70ade3b9900dbe97bd73be9c02e924ff3c986 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-767m-xrhc-fxm7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-394x-274p-mqc6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41359 · Security Note
• https://osv.dev/vulnerability/GHSA-767m-xrhc-fxm7 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-privilege-escalation-via-operator-write-to-admin-class-telegram-config-and-cron-persistence · Note
• https://twitter.com/CVEnew/status/2048168349037985851 · Twitter Post