CVE-2026-41379: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41379 is a privilege escalation vulnerability in OpenClaw (npm package) affecting all versions up to and including 2026.3.24. Authenticated operators with operator.write permissions can exploit the chat.send endpoint to access and modify admin-class Talk Voice configuration persistence settings that should be restricted to administrators only. The vulnerability was published on April 28, 2026, and a patch was released in version 2026.3.28. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is an incorrect authorization check (CWE-863 / CWE-269 Improper Privilege Management) in the extensions/talk-voice plugin's /voice set command handler. When a request arrives via the webchat channel (i.e., through the gateway), the code failed to verify that the caller held the operator.admin scope before invoking writeConfigFile, allowing a caller with only operator.write to bypass the admin-only config.patch RPC by routing through chat.send → /voice set. The fix enforces an explicit scope check: ctx.gatewayClientScopes?.includes('operator.admin') using optional chaining to also reject webchat callers with undefined scopes, matching the established pattern in the phone-control module (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated operator with operator.write privileges to persistently modify sensitive Talk Voice configuration settings (e.g., TTS provider, API keys, voice selection) that are intended to be administrator-only. The primary impact is high integrity loss — unauthorized alteration of critical voice system configurations — with low confidentiality exposure (limited read access to configuration data). Availability is not directly impacted, but unauthorized configuration changes could disrupt voice services or redirect TTS processing to attacker-controlled endpoints (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires authenticated access with at least operator.write privileges, limiting the attack surface to trusted-but-lower-privileged users. The EPSS score is approximately 0.02%, reflecting low probability of near-term exploitation. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

1. Obtain operator.write credentials: Acquire an account or API token with operator.write scope on a vulnerable OpenClaw instance (version ≤ 2026.3.24).
2. Connect via the webchat/gateway channel: Establish a session through the gateway interface (webchat channel), which is the code path that lacked the admin scope check.
3. Send a crafted /voice set command via chat.send: Issue a chat.send request containing the /voice set <voice_name> command. Because the operator.admin scope check was absent, the handler proceeds to writeConfigFile without authorization.
4. Modify admin-class voice configuration: The writeConfigFile call persists the attacker-chosen voice/TTS provider configuration to disk, overwriting admin-controlled settings. This could include substituting a TTS provider API key or redirecting voice synthesis to an attacker-controlled service (GitHub Commit, GitHub Advisory).

• Logs: Application logs showing /voice set commands issued from the webchat channel by accounts holding only operator.write scope (not operator.admin); unexpected writeConfigFile invocations in talk-voice plugin logs.
• File System: Unexpected modifications to the Talk Voice configuration file (e.g., changed TTS provider, altered API keys, or modified voice selection) with timestamps inconsistent with administrator activity.
• Network: Outbound TTS/voice API requests to unfamiliar or attacker-controlled endpoints following a configuration change event.
• Application Events: chat.send events routed to the /voice set handler from gateway/webchat sessions with low-privilege operator tokens (GitHub Commit).

Upgrade OpenClaw to version 2026.3.28 or later, which enforces the operator.admin scope check on all /voice set configuration writes from gateway clients (fix commit e34694733fc64931ed4a543c73d84ad3435d5df1). As an interim workaround, restrict operator.write permissions to only fully trusted users and audit existing operator accounts for unnecessary privilege grants. After patching, review Talk Voice configuration files for unauthorized changes and rotate any TTS provider API keys that may have been exposed or altered (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher zpbrent and acknowledged by the OpenClaw maintainers, who classified it as "moderate" severity with a "narrow" triage status, noting it represents a real but narrow authenticated persistence-class bug. The maintainer assessment normalized the severity below high, citing the requirement for prior authentication and the limited scope of impact (GitHub Advisory).