High severity8.8NVD Advisory· Published Apr 23, 2026· Updated Apr 29, 2026

CVE-2026-41349

Description

OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter. Remote attackers can exploit this to bypass security controls and execute unauthorized operations without user consent.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenClaw/Openclaw
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
Range: <2026.3.28

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/76411b2afc4ae721e36c12e0ea24fd23e2fed61envdPatch
github.com/openclaw/openclaw/security/advisories/GHSA-v3qc-wrwx-j3pwnvdVendor AdvisoryPatch
www.vulncheck.com/advisories/openclaw-agentic-consent-bypass-via-config-patchnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000