VULNERABILITY INTELLIGENCE

CVE-2026-41371

CVSS score8.5 HIGH
EPSS probability0.26%
CISA KEVNot currently listed
Published2026-04-28
Last modified2026-07-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Description

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript state, and force new session IDs without requiring admin scope by exploiting improper authorization checks in the chat.send path.

Weakness classification

  • disclosure@vulncheck.com: CWE-863

Primary references