Authorization Bypass in OpenClaw Chat Gateway by OpenClaw

CVE-2026-41299

What is CVE-2026-41299?

OpenClaw versions before 2026.3.28 are susceptible to an authorization bypass in the chat.send gateway method. This vulnerability allows authenticated operator clients to spoof ACP identity labels by manipulating self-declared client metadata during the WebSocket handshake. As a result, reserved provenance fields, which should only be accessible to the ACP bridge, can be injected, posing significant risks to data integrity and security. Awareness and prompt patching are essential for organizations using this application.

References