Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: OpenClaw 2026.3.28 Clear all filters
TI-2026-29960 CVE-2026-41359 · GHSA-767m-xrhc-fxm7

OpenClaw < 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistence

Priority LOW 31

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Telegram configuration and cron persistence settings via the send endp…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00232 Published 2026-04-23 Fixed in 2026.3.28 CWE-269
TI-2026-29950 CVE-2026-41349 · GHSA-7f25-vhj7-mxrc

OpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch

Priority MEDIUM 40

OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00473 Published 2026-04-23 Fixed in 2026.3.28 CWE-862
TI-2026-29945 CVE-2026-41344 · GHSA-5h2w-qmfp-ggp6

OpenClaw < 2026.3.28 - Privilege Escalation via chat.send /verbose Parameter

Priority LOW 23

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verboseLevel session overrides.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00209 Published 2026-04-23 Fixed in 2026.3.28 CWE-863