CVE-2026-41349: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41349 is an agentic consent bypass vulnerability in OpenClaw, an npm package, that allows LLM agents to silently disable execution approval controls via the config.patch parameter. Affecting all versions before 2026.3.28, the flaw enables remote attackers with low-level privileges to bypass security controls and execute unauthorized operations without user consent. It was published on April 23, 2026, with a fix shipped in version 2026.3.28. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, OpenClaw Advisory).

The root cause is a missing authorization check (CWE-862) in OpenClaw's gateway tool, which failed to validate or restrict modifications to protected configuration paths (tools.exec.ask and tools.exec.security) when LLM agents invoked config.patch or config.apply actions. An attacker with low-level network access could craft a config.patch payload — for example, { tools: { exec: { ask: "off" } } } — and submit it to the gateway tool, which would forward the write RPC without comparing the proposed configuration against the current protected settings. The fix (commit 76411b2) introduced an assertGatewayConfigMutationAllowed guard that fetches the current config snapshot via config.get before any write operation and rejects changes to the protected paths tools.exec.ask and tools.exec.security, including legacy aliases such as tools.bash.security (OpenClaw Commit, OpenClaw Advisory).

Successful exploitation allows an attacker to silently disable execution approval requirements within OpenClaw, enabling unauthorized command execution without user consent or awareness. This results in high impact to confidentiality, integrity, and availability of the affected system, as the attacker can execute arbitrary operations under the guise of a legitimate LLM agent workflow. The attack requires only low privileges and no user interaction, making it particularly dangerous in automated or agentic deployment environments (GitHub Advisory, OpenClaw Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.106–0.136%, placing it in the 33rd percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify OpenClaw npm deployments running versions prior to 2026.3.28, particularly those exposing the gateway tool interface over a network with LLM agent integrations enabled.
2. Obtain low-privilege access: Acquire credentials or a session token with at least low-level privileges sufficient to invoke gateway tool actions (e.g., a standard user or agent API key).
3. Craft malicious config.patch payload: Construct a JSON5 payload targeting the protected execution approval settings, such as { tools: { exec: { ask: "off" } } } to disable the execution approval prompt, or { tools: { exec: { security: "full" } } } to escalate execution permissions.
4. Submit config.patch action: Send the crafted payload to the OpenClaw gateway tool via the config.patch action. In unpatched versions, the gateway tool forwards the write RPC without checking whether protected config paths are being modified.
5. Execute unauthorized operations: With execution approval silently disabled, the LLM agent can now execute commands or operations that would previously have required explicit user consent, achieving unauthorized code or command execution (OpenClaw Advisory, OpenClaw Commit).

• Logs: Gateway tool logs showing config.patch or config.apply actions that modify tools.exec.ask or tools.exec.security fields, especially setting ask to "off" or security to "full"; absence of expected user-consent prompts preceding exec operations.
• Configuration: OpenClaw configuration files or snapshots where tools.exec.ask is set to "off" or tools.exec.security has been unexpectedly changed; presence of legacy alias changes under tools.bash.security.
• Process/Behavior: Unexpected or unsanctioned command executions by LLM agents without corresponding user approval events in audit logs; agent activity logs showing exec operations that bypass the normal approval workflow (OpenClaw Commit, OpenClaw Advisory).

Upgrade all OpenClaw installations to version 2026.3.28 or later, which contains the fix introduced in commit 76411b2 on March 27, 2026. No official workaround is documented for versions that cannot be immediately upgraded; however, organizations should implement access controls to restrict which users or agents can invoke config.patch and config.apply gateway actions, and monitor configuration change logs for unauthorized modifications to tools.exec.ask or tools.exec.security. Given the low attack complexity and network accessibility, patching should be treated as high priority (OpenClaw Advisory, OpenClaw Commit).

The vulnerability was reported by researcher YLChen-007 and acknowledged by OpenClaw maintainers, who accepted the issue and shipped a fix in v2026.3.28. Coverage appeared on The Hacker Wire and was noted by the Centre for Cybersecurity Belgium (CCB), which issued a warning about high-severity vulnerabilities in OpenClaw that could lead to remote code execution. Community discussion was limited but the advisory was tracked across multiple vulnerability aggregators shortly after disclosure (The Hacker Wire, CCB Advisory).