VYPR
← All advisories
High severity8.5NVD Advisory· Published Apr 28, 2026· Updated Apr 28, 2026

CVE-2026-41371

CVE-2026-41371

Description

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript state, and force new session IDs without requiring admin scope by exploiting improper authorization checks in the chat.send path.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • OpenClaw/Openclaw2 versions
    cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.3.28
    • (no CPE)range: <2026.3.28

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.