CVE-2026-41371 - Vulnerability Analysis

Overview

OpenClaw < 2026.3.28 contains a privilege escalation caused by improper authorization checks in chat.send, letting write-scoped gateway callers reset admin-only sessions, exploit requires write-scoped gateway access.

Severity & Score

Impact

Attackers can reset sessions, rotate session IDs, and archive transcripts without admin privileges, compromising session integrity.

Mitigation

Update to version 2026.3.28 or later.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-5r8f-96gm-5j6g
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-chat-send-reset-command

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner