PT-2026-37005

CVE-2026-42433

Published

2026-04-17

Updated

2026-05-05

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10

Description An authorization bypass exists where gateway 'operator.write' message-tool paths can access Matrix profile persistence, which should require admin-level authority. This occurs due to insufficient access controls, allowing attackers to mutate persistent profile configuration through non-owner message-tool runs.

Recommendations Update to version 2026.4.10 or newer.

Exploitability

Exploit

Fix

Impacts

Researchers

Peng Zhou

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

CWE-266: Incorrect Privilege Assignment