CVE-2026-41375: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41375 is an authorization bypass vulnerability in OpenClaw (npm package) affecting all versions before 2026.3.28. The flaw exists in the /phone arm and /phone disarm command endpoints, which failed to properly enforce operator.admin scope checks for external (non-webchat) channels, allowing low-privileged attackers to perform administrative phone channel operations. It was reported by AntAISecurityLab, fixed in commit aa66ae1 on 2026-03-27, and publicly disclosed on April 28, 2026. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is Incorrect Authorization (CWE-863): the original code in extensions/phone-control/index.ts only enforced the operator.admin scope check when the request originated from the webchat channel (ctx.channel === "webchat"), leaving all other external channels (e.g., Telegram) completely unchecked. An attacker with any low-level authenticated access could send /phone arm or /phone disarm commands via an external channel and bypass the administrative scope requirement entirely. The fix, applied in commit aa66ae1, removed the channel-specific condition so that operator.admin is now required universally across all channels (GitHub Commit, GitHub Advisory). A similar bypass existed in the talk-voice extension's /voice set command and was patched in the same commit.

Successful exploitation allows a low-privileged attacker to arm or disarm phone channels without administrative privileges, directly compromising the integrity of communication system security controls. There is no confidentiality or availability impact — the vulnerability is limited to unauthorized modification of phone channel configuration state. In environments where phone channel arming/disarming controls security-sensitive workflows (e.g., call routing, emergency response systems), unauthorized manipulation could have significant operational consequences (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.051%, reflecting low current exploitation probability. The vulnerability is network-exploitable with low attack complexity and requires only low-level privileges (any authenticated user on an external channel), making it relatively straightforward to exploit if an attacker has channel access. No threat actor attribution or CISA KEV catalog listing has been identified (Feedly, GitHub Advisory).

1. Gain low-privileged access: Obtain any authenticated session or API token for an OpenClaw instance that grants access to an external channel (e.g., Telegram integration) — operator.admin scope is not required.
2. Identify the target endpoint: Confirm the OpenClaw instance is running a version ≤ 2026.3.24 (vulnerable range) by checking the npm package version or API responses.
3. Send a crafted command via external channel: Transmit a /phone arm or /phone disarm command through the external channel (e.g., Telegram bot interface) without possessing the operator.admin scope. In the vulnerable code, the scope check is only applied for webchat channel requests.
4. Achieve unauthorized administrative action: The command handler processes the request without enforcing the admin scope check, successfully arming or disarming the phone channel configuration and writing the change to the config file (GitHub Commit, GitHub Advisory).

• Logs: OpenClaw application logs showing /phone arm or /phone disarm commands executed from external channels (e.g., channel: telegram) by users lacking operator.admin scope; absence of authorization error messages ("requires operator.admin") in logs for such requests on vulnerable versions.
• File System: Unexpected or unauthorized modifications to the OpenClaw phone-control configuration file (writeConfigFile calls) at unusual times or by non-administrative users.
• Application Behavior: Phone channels transitioning between armed/disarmed states without corresponding administrative user activity in audit trails.

Upgrade OpenClaw (npm) to version 2026.3.28 or later, which enforces operator.admin scope checks universally across all channels for /phone arm, /phone disarm, and /voice set commands. As a temporary workaround prior to patching, restrict network or API access to the /phone arm and /phone disarm endpoints to trusted systems only, and review access logs for any unauthorized arm/disarm activity. The fix is available in commit aa66ae1 (GitHub Commit, GitHub Advisory).

The vulnerability was reported by security researcher AntAISecurityLab and acknowledged by OpenClaw maintainers, who accepted the issue and shipped a fix in v2026.3.28. The GitHub Security Advisory (GHSA-h2v7-xc88-xx8c) was published with a "Moderate" severity rating. No significant broader media coverage or notable community discussion beyond the advisory has been identified (GitHub Advisory).