Privilege Escalation Vulnerability in OpenClaw by OpenClaw

CVE-2026-41359

What is CVE-2026-41359?

The OpenClaw software prior to version 2026.3.28 is affected by a vulnerability that enables authenticated operators with write permissions to exploit insufficient access controls. This flaw allows malicious users to access sensitive administrative settings, including Telegram configuration and cron persistence mechanisms, through the send endpoint. Attackers with operator.write credentials can gain unauthorized access to these critical functionalities, potentially leading to further exploitation of the system.

References