PT-2026-34780

CVE-2026-41349

Published

2026-04-03

Updated

2026-04-25

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description An agentic consent bypass allows LLM agents to silently disable execution approval. Remote attackers can exploit this by using the config.patch parameter to bypass security controls and execute unauthorized operations without user consent.

Recommendations Update to version 2026.3.28 or later. Avoid using the config.patch parameter until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Edward-X

Vendors

Affected products

Weakness enumeration

CWE-285: Improper Authorization

CWE-862: Missing Authorization