OpenClaw CVE-2026-41299

Requires valid operator-level authentication credentials to the OpenClaw platform - this is not exploitable by anonymous or unauthenticated attackers (PR:L in CVSS vector). Exploitation targets deployments where the chat.send gateway WebSocket endpoint is enabled and reachable by authenticated operator sessions. The vulnerable code path is triggered when clients establish WebSocket connections and send chat messages with provenance fields, which is standard chat functionality rather than a non-default feature. No specific protocol versions, operating systems, or deployment architectures limit exploitation beyond the authentication requirement. The attack is constrained by the need for existing operator credentials, which distinguishes this from unauthenticated remote exploitation scenarios. Organizations that restrict operator account creation to internal trusted personnel face lower practical risk than those exposing operator registration to external or semi-trusted users.

Real-world risk is moderate despite the 7.1 CVSS score. The CVSS vector shows network exploitability (AV:N) with low attack complexity (AC:L), but requires prior authentication (PR:L), creating a meaningful barrier. EPSS score of 0.05% (15th percentile) indicates very low observed exploitation probability in the wild. CISA SSVC framework assesses this as non-automatable with no active exploitation and partial technical impact, suggesting it requires operator-level access and manual exploitation steps. The high integrity impact (VI:H) is constrained to message provenance spoofing rather than system-level compromise, limiting blast radius to chat metadata integrity. The vulnerability enables privilege escalation within the chat subsystem but does not grant arbitrary code execution or data exfiltration. Organizations using OpenClaw should prioritize patching based on whether operator-level accounts are exposed to untrusted users, but this is not a critical emergency requiring immediate response. Patch availability since March 2026 reduces urgency for unpatched systems.

An attacker with legitimate operator-level credentials to OpenClaw establishes a WebSocket connection to the chat.send gateway, crafting the connection handshake to include client metadata claiming ACP bridge identity. When sending chat messages, the attacker injects reserved provenance fields normally restricted to the privileged ACP component, such as administrative approval stamps or elevated trust markers. The gateway incorrectly validates these fields against the spoofed metadata rather than the session's actual low-privilege authorization state. The attacker's messages now carry false provenance suggesting they originated from the trusted ACP bridge, potentially influencing downstream authorization decisions, audit trails, or user trust indicators within the chat system.