CVE-2026-41349 - OpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch

Back Back to CVE browser

HIGH

OpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch

Published Apr 23, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.84%

Description

OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter. Remote attackers can exploit this to bypass security controls and execute unauthorized operations without user consent.

Affected products

Vendor OpenClaw Product OpenClaw Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2026.3.28
- Version
  2026.3.28
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenClaw

unaffected

Version	Status	Constraints
0	affected	<2026.3.28
2026.3.28	unaffected	-

Ecosystem	Package	Introduced	Fixed
npm	openclaw	0	2026.3.28

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25333
Advisory
https://github.com/openclaw/openclaw/commit/76411b2afc4ae721e36c12e0ea24fd23e2fed61e
patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-v3qc-wrwx-j3pw
vendor-advisoryPatchVendor Advisory
https://www.vulncheck.com/advisories/openclaw-agentic-consent-bypass-via-config-patch
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25333		Advisory
https://github.com/openclaw/openclaw/commit/76411b2afc4ae721e36c12e0ea24fd23e2fed61e		patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-v3qc-wrwx-j3pw		vendor-advisoryPatchVendor Advisory
https://www.vulncheck.com/advisories/openclaw-agentic-consent-bypass-via-config-patch		third-party-advisoryThird Party Advisory