CVE-2026-41299: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41299 is an authorization bypass vulnerability in OpenClaw, a Node.js package, affecting all versions before 2026.3.28. The flaw exists in the chat.send gateway method, where ACP (Access Control Platform)-only provenance fields are gated by self-declared client metadata from the WebSocket handshake rather than verified server-side authorization state. This allows authenticated operator clients to spoof ACP identity labels and inject reserved provenance fields intended exclusively for the ACP bridge. The vulnerability was published on April 21, 2026, with a patch released in version 2026.3.28. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, VulnCheck).

The root cause is classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision) and CWE-290 (Authentication Bypass by Spoofing). The vulnerable components are src/gateway/server-methods/chat.ts and src/gateway/server/ws-connection/message-handler.ts, where the server trusts client-supplied metadata provided during the WebSocket handshake to determine whether a client is authorized to set ACP-only provenance fields. An authenticated operator can manipulate this metadata at connection time to impersonate the ACP bridge identity, bypassing the intended access control gate. The fix, introduced in commit 4b9542716c, enforces verified scope checks server-side rather than relying on client-declared identity (GitHub Advisory).

Successful exploitation allows an authenticated operator to forge ACP identity labels and inject reserved provenance fields into chat messages, compromising data integrity. This could enable unauthorized privilege escalation within the chat system, manipulation of message provenance metadata, and potential abuse of trust relationships that downstream systems place on ACP-sourced messages. Confidentiality impact is low (limited exposure of internal metadata structures), while integrity impact is high due to the ability to inject falsified authorization claims (GitHub Advisory, VulnCheck).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires an authenticated operator account and network access, but no user interaction. The EPSS score is approximately 0.048% (0.000480), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (VulnCheck).

1. Obtain operator credentials: Acquire a valid authenticated operator account on a target OpenClaw instance running a version prior to 2026.3.28.
2. Initiate WebSocket connection: Establish a WebSocket connection to the OpenClaw gateway endpoint, manipulating the client metadata fields in the handshake headers or payload to declare an ACP bridge identity (e.g., setting client type or identity labels to match expected ACP bridge values).
3. Invoke chat.send gateway method: Send a chat.send gateway method call over the established WebSocket connection, including reserved ACP-only provenance fields in the message payload that would normally be rejected for non-ACP clients.
4. Inject forged provenance: Because the server validates provenance access based on the spoofed client metadata rather than verified authorization state, the reserved fields are accepted and stored/forwarded as if originating from the legitimate ACP bridge.
5. Achieve objective: Downstream systems or users that trust ACP-sourced provenance metadata receive manipulated messages with forged authorization claims, enabling privilege abuse or integrity compromise (GitHub Advisory).

• Network: Unexpected WebSocket connections from operator-tier clients that include ACP bridge identity metadata in handshake headers; chat.send calls containing reserved provenance fields from non-ACP client sessions.
• Logs: Server-side gateway logs showing chat.send invocations with ACP provenance fields from sessions authenticated as standard operator accounts rather than the ACP bridge service account; anomalous client metadata values in WebSocket connection logs.
• Application Behavior: Chat messages appearing with ACP-attributed provenance labels that do not correspond to actual ACP bridge activity; unexpected provenance field values in stored or forwarded chat records.

The primary remediation is to upgrade OpenClaw to version 2026.3.28 or later, which enforces server-side verified scope checks for ACP provenance fields (commit 4b9542716c). As an interim measure, restrict operator account privileges to the minimum necessary and audit WebSocket connection logs for suspicious client metadata patterns. Additionally, implement network-level controls to limit which clients can reach the OpenClaw gateway, reducing the attack surface until patching is complete (GitHub Advisory, VulnCheck).

The vulnerability was reported by security researcher zpbrent and the advisory was published by steipete on the OpenClaw GitHub repository. No significant broader media coverage or notable public researcher commentary beyond the official advisory and VulnCheck tracking entry has been identified at this time (GitHub Advisory).