Which versions of OpenClaw are affected by CVE-2026-41299?

CVE-2026-41299 is an authorization bypass in OpenClaw's chat gateway that allows low-privilege operator accounts to forge message authenticity and impersonate trusted system authorities through…. A patch is available.

How to fix or mitigate CVE-2026-41299?

Within 24 hours: inventory all OpenClaw deployments and identify systems running the chat.send gateway with operator role assignments; document current operator account holdings. Within 7 days: restrict operator role assignments to only essential personnel; implement network segmentation isolating WebSocket handshake traffic for monitoring and logging of metadata anomalies. Within 30 days: establish a vendor communication cadence for patch availability; evaluate migration to alternative chat platforms if OpenClaw cannot provide timeline to remediation.

OpenClaw CVE-2026-41299

Q: What is the CVSS score of CVE-2026-41299?

CVE-2026-41299 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Reliance on Untrusted Inputs in a Security Decision (CWE-807)

2026-04-21 disclosure@vulncheck.com

GHSA-6xg4-82hv-cp6f

Authentication Bypass Openclaw

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 21, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 21, 2026 - 00:39 vuln.today

Analysis Generated

Apr 21, 2026 - 00:22 vuln.today

CVE Published

Apr 21, 2026 - 00:16 nvd

HIGH 7.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.28.

DescriptionCVE.org

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-declared client metadata from WebSocket handshake rather than verified authorization state. Authenticated operator clients can spoof ACP identity labels and inject reserved provenance fields intended only for the ACP bridge by manipulating client metadata during connection.

AnalysisAI

Authorization bypass in OpenClaw's chat.send gateway allows authenticated operator clients to spoof ACP (Access Control Provider) identity labels and inject reserved provenance metadata by manipulating WebSocket handshake client metadata. Attackers with low-privilege operator credentials can bypass intended privilege boundaries to impersonate the ACP bridge, achieving high integrity impact through unauthorized modification of chat message provenance. EPSS probability is low (0.05%, 15th percentile) and CISA SSVC indicates no active exploitation, non-automatable attacks, and partial technical impact. Vendor patch available as of version 2026.3.28.

Technical ContextAI

OpenClaw implements a WebSocket-based chat gateway where messages carry provenance fields identifying their source authority level. The ACP (Access Control Provider) bridge is a privileged component that should exclusively control certain metadata fields marking messages with elevated trust. The vulnerability stems from CWE-807 (Reliance on Untrusted Inputs in a Security Decision) where the gateway trusts self-declared client metadata from the WebSocket handshake to determine whether provenance fields are permitted, rather than validating against the authenticated session's actual authorization state. This creates a Confused Deputy scenario where the gateway makes security decisions based on client-controlled data. The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-exploitable with low complexity once low-privilege authentication is obtained, with high integrity impact to the vulnerable system (VI:H) but limited confidentiality impact (VC:L).

RemediationAI

Upgrade to OpenClaw version 2026.3.28 or later, which implements proper authorization state validation for provenance fields independent of client-supplied WebSocket metadata. Refer to the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-6xg4-82hv-cp6f for upgrade instructions. If immediate patching is not feasible, implement compensating controls: disable the chat.send gateway endpoint until patching is complete (eliminates attack surface but removes chat functionality), restrict operator-level account provisioning to highly trusted users only (reduces threat actor pool), or deploy network-level access controls limiting WebSocket connections to verified client IP ranges (increases attack complexity but may impact legitimate distributed users). Log and monitor for anomalous provenance fields in chat messages that claim ACP bridge origin but originate from operator sessions, though this detection approach is reactive rather than preventive. Each workaround trades functionality or operational flexibility for reduced risk.