CVE-2026-41375: OpenClaw Authorization Bypass Vulnerability

CVE-2026-41375 Overview

OpenClaw before version 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin scope checks for external channels. This vulnerability allows attackers to bypass authentication restrictions to arm or disarm phone channels without proper administrative privileges.

The root cause lies in an improper authorization check (CWE-863) where the admin scope validation was only enforced for the webchat channel, leaving external channels completely unprotected. This means any authenticated user with basic access could invoke privileged phone control commands through alternative channels, effectively bypassing the intended access control model.

Critical Impact
Attackers with low-privilege access can bypass administrative authorization controls to manipulate phone arm/disarm functionality through external channels, potentially compromising physical security integrations.

Affected Products

OpenClaw versions prior to 2026.3.28
Phone Control Extension (extensions/phone-control/index.ts)
Talk Voice Extension (extensions/talk-voice/index.ts)

Discovery Timeline

2026-04-28 - CVE-2026-41375 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41375

Vulnerability Analysis

This authorization bypass vulnerability stems from an incomplete access control check in OpenClaw's phone control extension. The vulnerability manifests when the application validates administrative privileges based on the communication channel rather than universally enforcing the operator.admin scope requirement.

The vulnerable code path only verified administrator permissions when requests arrived through the webchat channel. External channel integrations could invoke the same privileged operations without triggering the authorization check, allowing users without the operator.admin scope to execute administrative commands that should be restricted.

This vulnerability has significant implications for organizations using OpenClaw's phone control integrations, as it could allow unauthorized users to arm or disarm phone channels, potentially disrupting communication systems or bypassing security controls.

Root Cause

The vulnerability exists due to improper authorization logic in the phone control and voice configuration endpoints. The original implementation conditionally checked for the operator.admin scope only when ctx.channel === "webchat", creating a bypass path for requests originating from any other channel type.

This design flaw violates the principle of defense in depth by assuming that non-webchat channels would have their own authorization controls. In practice, external channels could route requests directly to these endpoints without triggering the administrative privilege check.

Attack Vector

An attacker with low-level authenticated access to OpenClaw can exploit this vulnerability by:

Establishing a connection through an external channel (not webchat)
Sending commands to the /phone disarm or /phone arm endpoints
Bypassing the operator.admin scope check entirely
Successfully executing privileged phone control operations

The following patch demonstrates the vulnerable code and the security fix applied:

typescript

         }
 
         if (action === "disarm") {
-          if (ctx.channel === "webchat" && !ctx.gatewayClientScopes?.includes("operator.admin")) {
+          if (!ctx.gatewayClientScopes?.includes("operator.admin")) {
             return {
-              text: "⚠️ /phone disarm requires operator.admin for internal gateway callers.",
+              text: "⚠️ /phone disarm requires operator.admin.",
             };
           }
           const res = await disarmNow({

Source: GitHub Commit Update

A similar fix was applied to the voice configuration endpoint:

typescript

         }
 
         if (action === "set") {
-          // Persistent config writes require operator.admin for gateway clients.
-          // Without this check, a caller with only operator.write could bypass the
-          // admin-only config.patch RPC by reaching writeConfigFile indirectly
-          // through chat.send → /voice set.
-          if (ctx.channel === "webchat" && !ctx.gatewayClientScopes?.includes("operator.admin")) {
-            return { text: `⚠️ ${commandLabel} set requires operator.admin for gateway clients.` };
+          // Persistent config writes require operator.admin on every channel.
+          // Without this check, external channel senders could bypass the
+          // admin-only config.patch RPC by reaching writeConfigFile indirectly.
+          if (!ctx.gatewayClientScopes?.includes("operator.admin")) {
+            return { text: `⚠️ ${commandLabel} set requires operator.admin.` };
           }
 
           const query = tokens.slice(1).join(" ").trim();

Source: GitHub Commit Update

Detection Methods for CVE-2026-41375

Indicators of Compromise

Unexpected /phone arm or /phone disarm command executions from non-webchat channels
Users without operator.admin scope successfully executing phone control commands
Audit log entries showing configuration changes from external channel integrations
Anomalous activity patterns in voice or phone control extension logs

Detection Strategies

Implement logging for all phone control endpoint invocations, capturing channel type and user scopes
Monitor for successful phone arm/disarm operations originating from users lacking operator.admin scope
Create alerts for command execution patterns from external channels accessing privileged endpoints
Review authentication and authorization logs for scope mismatches

Monitoring Recommendations

Enable verbose logging on the phone-control and talk-voice extensions
Implement real-time alerting for privileged operation execution from non-admin users
Establish baseline patterns for legitimate phone control usage to identify anomalies
Deploy application-level monitoring to track authorization check bypass attempts

How to Mitigate CVE-2026-41375

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.28 or later immediately
Audit logs for any unauthorized phone control operations executed through external channels
Review user access and scope assignments for the operator.admin privilege
Temporarily disable external channel integrations if immediate patching is not possible

Patch Information

OpenClaw has addressed this vulnerability in version 2026.3.28. The fix removes the channel-specific condition from the authorization check, ensuring that operator.admin scope is required universally regardless of the originating channel.

The security patch is available in commit aa66ae1fc797d3298cc409ed2c5da69a89950a45. For additional details, refer to the GitHub Security Advisory or the VulnCheck Advisory.

Workarounds

Restrict access to external channel integrations at the network level until patching is complete
Implement additional authorization middleware to validate operator.admin scope before phone control endpoints
Disable the phone-control and talk-voice extensions if they are not critical to operations
Apply network segmentation to limit which systems can access OpenClaw's external channel interfaces

bash

# Example: Disable phone-control extension temporarily
# In your OpenClaw configuration, disable the affected extensions
OPENCLAW_DISABLED_EXTENSIONS="phone-control,talk-voice"

# Restart the OpenClaw service to apply changes
systemctl restart openclaw