CVE-2026-41359: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41359 is a privilege escalation vulnerability in OpenClaw (npm package) that allows authenticated operators with operator.write credentials to access admin-class Telegram configuration and cron persistence settings via the send endpoint. It affects all OpenClaw versions prior to 2026.3.28 (specifically <=2026.3.24 per the canonical advisory). The vulnerability was reported by researcher @zpbrent, disclosed on April 23, 2026, and patched in version 2026.3.28 released March 28, 2026. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory GHSA-767m-xrhc-fxm7, GitHub Advisory GHSA-394x-274p-mqc6).

The root cause is improper privilege management (CWE-269): the send endpoint in OpenClaw's Telegram extension fails to enforce an admin-level scope gate, allowing lower-privileged operator.write accounts to reach administrative functionality intended only for admin-class roles. Specifically, the fix commit (b7d70ade) introduced a requirement for operator.admin privileges for legacy target writeback persistence in extensions/telegram/src/target-writeback.ts, confirming that no such check existed previously. The attack is network-based, requires only low privileges (valid operator.write credentials), no user interaction, and low attack complexity — making it straightforward to exploit for any authenticated operator (GitHub Advisory GHSA-767m-xrhc-fxm7, Fix Commit).

A successful exploit allows an attacker with operator.write credentials to read and modify admin-restricted Telegram bot configuration and cron-based persistence settings. This could be leveraged to establish backdoors, maintain unauthorized persistent access, redirect Telegram notifications, or manipulate scheduled tasks — all without requiring admin credentials. The confidentiality impact is limited (low, per CVSS v4), but the integrity impact is high, as attackers can alter critical system configurations and persistence mechanisms (GitHub Advisory GHSA-767m-xrhc-fxm7, GitHub Advisory GHSA-394x-274p-mqc6).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.02%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid operator.write credentials, limiting the attack surface to authenticated insiders or compromised operator accounts (GitHub Advisory GHSA-394x-274p-mqc6).

1. Obtain operator.write credentials: Acquire valid operator.write credentials for the target OpenClaw instance, either through credential theft, phishing, or insider access.
2. Identify the send endpoint: Locate the OpenClaw gateway's send API endpoint (e.g., via API documentation or network traffic inspection).
3. Craft a privileged request: Authenticate with operator.write credentials and send a crafted request to the send endpoint that targets admin-class Telegram configuration or cron persistence parameters — parameters that should be restricted to admin-role users.
4. Modify admin-class settings: Use the unauthorized access to alter Telegram bot tokens/targets or modify cron persistence entries, potentially establishing a backdoor or redirecting notifications to attacker-controlled infrastructure.
5. Maintain persistence: Leverage modified cron settings to ensure continued unauthorized access even if credentials are rotated (GitHub Advisory GHSA-767m-xrhc-fxm7, Fix Commit).

• Logs: API access logs showing operator.write-authenticated requests to the send endpoint that include Telegram configuration or cron persistence parameters; unexpected modifications to Telegram target writeback settings logged around the time of operator activity.
• Configuration: Unauthorized changes to Telegram bot tokens, chat IDs, or target writeback configuration files (extensions/telegram/src/target-writeback.ts-related config); unexpected or new cron job entries added by an operator-level account.
• Process/Behavior: Cron jobs executing under operator account context that were not created by an admin; Telegram notifications being sent to unexpected recipients or bots.

Upgrade OpenClaw (npm) to version 2026.3.28 or later, which enforces operator.admin privilege checks on the Telegram target writeback and cron persistence functionality in the send endpoint. The fix was committed on March 25, 2026 (commit b7d70ade). As interim mitigations: audit all accounts holding operator.write permissions and revoke access for any untrusted users; restrict network access to the send endpoint; and review Telegram configuration and cron persistence settings for unauthorized changes (GitHub Advisory GHSA-767m-xrhc-fxm7, Fix Commit).

The canonical advisory (GHSA-767m-xrhc-fxm7) was published by maintainer @steipete and credits @zpbrent as the reporter. The maintainer's triage assessment noted the severity as "medium" in practice, stating the bug is a "real shipped operator.write to admin-class Telegram config or cron persistence bug, but it is an authenticated sink-specific escalation and high is too high given the narrower scope." A duplicate advisory (GHSA-394x-274p-mqc6) was published and subsequently withdrawn on May 6, 2026 (GitHub Advisory GHSA-767m-xrhc-fxm7, GitHub Advisory GHSA-394x-274p-mqc6).