PT-2026-35764

CVE-2026-41379

Published

2026-04-07

Updated

2026-05-01

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description Authenticated operators with write permissions can escalate privileges to access admin-class Talk Voice configuration persistence. This is possible by exploiting the 'chat.send' endpoint to reach and modify sensitive voice configuration settings intended exclusively for administrators.

Recommendations Update to version 2026.3.28 or later. Restrict access to the 'chat.send' endpoint for users with operator.write privileges to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Peng Zhou

Vendors

Affected products

Weakness enumeration

CWE-269: Improper Privilege Management

CWE-863: Incorrect Authorization

Related identifiers