CVE-2026-41344

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description A privilege escalation issue exists in the "chat.send" endpoint. Write-scoped gateway callers can persist admin-only verboseLevel session overrides by exploiting the /verbose parameter. This allows attackers to bypass access controls and expose sensitive reasoning or tool output that should be restricted to administrators.

Recommendations Update to version 2026.3.28 or later. As a temporary workaround, restrict access to the /verbose parameter in the "chat.send" endpoint.