CVE-2026-41344

Katalog CVE

CVSS 8.8 · High EPSS 0,39%

Kerentanan Incorrect Authorization pada openclaw. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verboseLevel session overrides. Attackers can exploit the /verbose parameter to bypass access controls and expose sensitive reasoning or tool output intended to be restricted to administrators.

Rincian

Terbit di NVD

23 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-5h2w-qmfp-ggp6 advisory vendor
• https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-chat-send-verbose-parameter advisory pihak ketiga