CoreCVE
Back

HIGH

OpenClaw < 2026.3.28 - Privilege Escalation via chat.send to Admin-Class Talk Voice Config

Published Apr 28, 2026

Description

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice configuration persistence. Attackers with operator.write privileges can exploit the chat.send endpoint to reach and modify sensitive voice configuration settings intended for administrators only.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-269

Improper Privilege Management

CWE-863

Incorrect Authorization

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Apr 28, 2026
Updated Apr 29, 2026
Reserved Apr 20, 2026
Link CVE-2026-41379
CISA Vulnrichment
Updated Apr 29, 2026
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2026-41379
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-41379
ENISA EUVD
Assigner VulnCheck
Published Apr 28, 2026
Updated Apr 29, 2026
Exploited since n/a
Link EUVD-2026-26088
EUVD-2026-26088 GHSA-3Q42-XMXV-9VFR