CVE-2026-41344: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41344 is a privilege escalation vulnerability in OpenClaw, an npm package, affecting all versions before 2026.3.28. The flaw exists in the chat.send endpoint, where write-scoped gateway callers (operator.write) can persist admin-only verboseLevel session overrides via the /verbose parameter, bypassing intended access controls. The vulnerability was published on April 23, 2026, with a patch released in version 2026.3.28. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Duplicate Advisory).

The root cause is Incorrect Authorization (CWE-863) and Improper Access Control (CWE-284): the chat.send code path in src/auto-reply/reply/directive-handling.impl.ts and src/gateway/sessions-patch.ts does not enforce the admin-only restriction when processing the /verbose parameter, allowing it to persist session-level verboseLevel overrides that should only be settable via the admin-restricted sessions.patch endpoint. An attacker with a valid write-scoped gateway credential can send a crafted chat.send request including the /verbose parameter to permanently elevate the verbosity of their session, exposing internal reasoning and tool output. No special configuration or user interaction is required beyond possessing operator.write scope. The fix was introduced in commit c603123528 ("fix(gateway): require admin for persisted verbose defaults") (GitHub Advisory).

Successful exploitation allows a write-scoped gateway caller to persistently enable verbose logging for their session, exposing sensitive internal reasoning, decision-making logic, and tool outputs that are intended to be restricted to administrators. This represents a confidentiality breach — non-administrative users gain visibility into privileged system internals — and a limited integrity impact, as unauthorized session state is modified. Availability is not directly impacted. The exposed data could reveal application logic, internal tool behavior, or sensitive data processed by the system, potentially facilitating further attacks (GitHub Advisory, Duplicate Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability has an EPSS score of approximately 0.046%, indicating a low probability of near-term exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid operator.write-scoped gateway credential, limiting the attacker pool to authenticated users with at least write-level access (Duplicate Advisory, Feedly).

1. Obtain write-scoped credentials: Acquire a valid operator.write-scoped gateway API key or session token for the target OpenClaw deployment (e.g., via a low-privilege account or compromised credentials).
2. Identify the chat.send endpoint: Locate the OpenClaw gateway's chat.send API endpoint on the target instance.
3. Craft a malicious request: Send a chat.send request to the endpoint that includes the /verbose parameter set to an elevated verbosity level, e.g.:

   POST /gateway/chat.send
   Authorization: Bearer <write-scoped-token>
   Content-Type: application/json
   
   { "message": "test", "verbose": true }

4. Persist the override: Due to the missing authorization check, the verboseLevel session override is persisted in the session store, bypassing the admin-only restriction enforced by sessions.patch.
5. Observe privileged output: Subsequent responses from the gateway will include verbose reasoning traces and tool outputs normally restricted to administrators, exposing sensitive internal application data (GitHub Advisory).

• Network: Unexpected chat.send API requests from non-administrative accounts that include a /verbose or verbose parameter; repeated such requests from the same source IP or token.
• Logs: Application logs showing verboseLevel session mutations originating from operator.write-scoped callers rather than admin accounts; entries in session store logs reflecting verboseLevel changes not initiated by admin sessions.
• Application Behavior: Verbose reasoning or tool output appearing in responses to non-administrative gateway sessions; session records in the data store showing elevated verboseLevel values associated with non-admin user identifiers (GitHub Advisory).

Upgrade OpenClaw to version 2026.3.28 or later, which contains the fix introduced in commit c603123528 that enforces admin-only authorization for persisted verbose defaults. As interim measures, audit and restrict gateway access controls to ensure only trusted users hold operator.write scope, and monitor chat.send endpoint requests for the presence of verbose parameters from non-administrative accounts. No configuration-only workaround is documented; upgrading is the recommended and only confirmed remediation (GitHub Advisory, Duplicate Advisory).

The vulnerability was reported by researcher zpbrent and published by maintainer steipete via the OpenClaw GitHub Security Advisory on March 29, 2026. The advisory was initially duplicated in the GitHub Advisory Database (GHSA-v3c2-39fm-jq4h) before being withdrawn on May 6, 2026, with the canonical advisory remaining at GHSA-5h2w-qmfp-ggp6. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified (GitHub Advisory, Duplicate Advisory).