Which versions of OpenClaw are affected by CVE-2026-41349?

OpenClaw versions before 2026.3.28 contain an authorization bypass allowing deployed LLM agents to disable critical execution-approval controls without user consent.. A patch is available.

How to fix or mitigate CVE-2026-41349?

Within 24 hours: Identify all systems running OpenClaw and determine current versions to assess exposure scope. Within 7 days: Deploy OpenClaw 2026.3.28 or later to all affected systems and verify the update is operational. Within 30 days: Conduct a security audit of any LLM agents or automation workflows that ran on vulnerable instances to ensure no execution-approval controls were disabled.

OpenClaw CVE-2026-41349

Q: What is the CVSS score of CVE-2026-41349?

CVE-2026-41349 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25333 HIGH

Missing Authorization (CWE-862)

2026-04-23 VulnCheck

GHSA-7f25-vhj7-mxrc

Authentication Bypass Openclaw

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Agent must already have privileged tool access (PR:L) and low complexity (AC:L); disabling the consent boundary to gain command execution crosses a security scope (S:C) with high C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 03:23 vuln.today

Analysis Generated

Jul 24, 2026 - 03:23 vuln.today

CVSS changed

Apr 23, 2026 - 22:28 NVD

8.8 (HIGH) 8.7 (HIGH)

EUVD ID Assigned

Apr 23, 2026 - 22:15 euvd

EUVD-2026-25333

Patch released

Apr 23, 2026 - 22:15 nvd

Patch available

CVE Published

Apr 23, 2026 - 21:58 nvd

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.28.

DescriptionCVE.org

OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter. Remote attackers can exploit this to bypass security controls and execute unauthorized operations without user consent.

AnalysisAI

Authorization bypass in OpenClaw before 2026.3.28 lets an LLM agent silently disable execution-approval controls by writing to protected configuration paths (tools.exec.ask and tools.exec.security) through the gateway tool's config.patch and config.apply actions. Once the exec-approval guardrail is turned off, the agent can run commands without the user consent prompt that normally gates them, effectively self-escalating its own operational authority. EPSS is low (0.11%, 28th percentile) and there is no public exploit identified at time of analysis, but the technical impact is rated total by CISA's SSVC framework and a vendor patch is available.

Technical ContextAI

OpenClaw is an agentic runtime (published on npm as the openclaw package) in which LLM agents call gateway tools to read and mutate their own runtime configuration. Command execution is guarded by exec-approval settings - specifically tools.exec.ask (when to prompt, e.g. 'on-miss') and tools.exec.security (e.g. 'allowlist' vs 'full'). The root cause is CWE-862 (Missing Authorization): the config.patch and config.apply gateway actions applied a JSON5 merge-patch to the live config without treating these approval settings as protected, so an agent could overwrite them the same way it edits any benign key. The commit diff (76411b2) introduces a PROTECTED_GATEWAY_CONFIG_PATHS allowlist ['tools.exec.ask','tools.exec.security'], fetches the current config via config.get, and rejects any patch/apply that would alter those paths - including via the legacy tools.bash alias that maps onto tools.exec.security, and including config.apply calls that omit the protected settings entirely.

RemediationAI

Vendor-released patch: upgrade the openclaw npm package to 2026.3.28 or later (2026.3.31 is the latest published release), which enforces the PROTECTED_GATEWAY_CONFIG_PATHS check as delivered in fix commit 76411b2afc4ae721e36c12e0ea24fd23e2fed61e. Follow the advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-v3qc-wrwx-j3pw. If you cannot upgrade immediately, the actionable compensating control is to prevent agents from mutating exec-approval settings: restrict or disable the gateway config.patch and config.apply actions for agent-facing tool calls, and treat tools.exec.ask and tools.exec.security (plus the legacy tools.bash alias) as read-only in your deployment; the trade-off is that legitimate agent-driven config changes will also be blocked. Additionally, keep tools.exec.security on 'allowlist' rather than 'full' and monitor for config mutations touching those keys, accepting that this adds operational friction to any workflow that legitimately reconfigures execution policy.