En bref
- CVE-2026-41371 est une vulnérabilité ÉLEVÉE (CVSS 8.5) touchant openclaw (openclaw), openclaw.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.26%, plus élevée que 17.1% des vulnérabilités.
- Correctif : mettre à jour vers 2026.3.28 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.28
| 2026.3.28
|
| openclaw npm | < 2026.3.28
| 2026.3.28
|
Description
Summary
The chat.send path reused command authorization to trigger /reset session rotation even though direct session reset is an admin-only control-plane operation.
Impact
A write-scoped gateway caller could rotate a target session, archive the prior transcript state, and force a new session id without admin scope.
Affected Component
src/gateway/server-methods/chat.ts, src/auto-reply/reply/session.ts
Fixed Versions
- Affected:
<= 2026.3.24
- Patched:
>= 2026.3.28
- Latest stable
2026.3.28 contains the fix.
Fix
Fixed by commit be00fcfccb (Gateway: align chat.send reset scope checks).
NVD description
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript state, and force new session IDs without requiring admin scope by exploiting improper authorization checks in the chat.send path.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free