Medium severity6.5NVD Advisory· Published Apr 28, 2026· Updated May 1, 2026
CVE-2026-41375
CVE-2026-41375
Description
OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin scope checks for external channels. Attackers can bypass authentication restrictions to arm or disarm phone channels without proper administrative privileges.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.3.28 | 2026.3.28 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/openclaw/openclaw/commit/aa66ae1fc797d3298cc409ed2c5da69a89950a45nvdPatch
- github.com/openclaw/openclaw/security/advisories/GHSA-h2v7-xc88-xx8cnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-h2v7-xc88-xx8cghsaADVISORY
- www.vulncheck.com/advisories/openclaw-authorization-bypass-in-phone-arm-and-phone-disarm-endpointsnvdThird Party Advisory
News mentions
0No linked articles in our index yet.