Privilege Escalation in OpenClaw Affects Admin-Only Voice Configuration
CVE-2026-41379

7.1HIGH

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
28 April 2026

What is CVE-2026-41379?

A privilege escalation vulnerability in OpenClaw allows authenticated operators with write permissions to exploit the chat.send endpoint. This exploitation grants them access to sensitive Talk Voice configuration settings, which are normally restricted to administrators. Attackers with operator.write privileges can manipulate these settings, posing a significant security risk.

Affected Version(s)

OpenClaw 0 < 2026.3.28

OpenClaw 2026.3.28

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/e34694733fc64...
patch
https://www.vulncheck.com/advisories/openclaw-privilege-e...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peng Zhou (@zpbrent)
.