CVE-2026-41379
highOpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voic…
Vendor / product: Openclaw — openclaw
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice configuration persistence. Attackers with operator.write privileges can exploit the chat.send endpoint to reach and modify sensitive voice configuration settings intended for administrators only.
CVSS
7.1
7.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-04-28 19:37
Modified: 2026-11-11 21:10
NVD status: Analyzed
Last synced 5 hours ago
Verified against the source API 2026-11-11 21:11 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
openclaw / openclaw <2026.3.28
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://github.com/openclaw/openclaw/commit/e34694733fc64931ed4a543c73d84ad3435d5df1 disclosure@vulncheck.com
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3q42-xmxv-9vfr disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-chat-send-to-admin-... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-11 21:11 UTC · record ↗