CVSS 4.0
8.4 highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:LCVE-2026-41371
High (8.4) in openclaw openclaw. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in openclaw 2026.3.28.
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript state, and force new session IDs without requiring admin scope by exploiting improper authorization checks in the chat.send path.
Severity
CVSS 3.1
8.5 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openclaw:openclaw
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5r8f-96gm-5j6g | npm | openclaw | <2026.3.28 | 2026.3.28 |