CVE-2026-41379: OpenClaw Privilege Escalation Vulnerability

CVE-2026-41379 Overview

CVE-2026-41379 is a privilege escalation vulnerability in OpenClaw before version 2026.3.28. The vulnerability allows authenticated operators with operator.write privileges to bypass authorization controls and access admin-class Talk Voice configuration persistence. Attackers can exploit the chat.send endpoint to reach and modify sensitive voice configuration settings that should be restricted to administrators only.

Critical Impact
Authenticated operators can escalate privileges to modify admin-only voice configuration settings, potentially compromising system integrity and enabling unauthorized configuration changes.

Affected Products

OpenClaw versions prior to 2026.3.28

Discovery Timeline

2026-04-28 - CVE CVE-2026-41379 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41379

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization), where the application fails to properly enforce authorization controls on sensitive configuration endpoints. The flaw exists in the Talk Voice extension's handling of configuration writes through the chat.send pathway.

The core issue stems from an authorization bypass where operators authenticated via the webchat gateway channel could leverage their operator.write scope to perform actions that should require operator.admin privileges. Specifically, the /voice set command could be used to write configuration changes that persist admin-only voice settings, despite the caller lacking sufficient authorization.

Root Cause

The root cause is a missing authorization check in the Talk Voice extension when processing configuration write operations through the chat.send endpoint. While the direct config.patch RPC correctly enforced admin-only access, the /voice set command provided an indirect pathway to the same underlying writeConfigFile function without equivalent scope validation for gateway clients.

Attack Vector

An attacker requires network access and must be authenticated with operator.write privileges. The attack leverages the webchat channel to bypass intended authorization boundaries:

Attacker authenticates as an operator with operator.write scope via the webchat gateway
Attacker sends a crafted message through chat.send invoking the /voice set command
The Talk Voice extension processes the request and writes configuration changes
Admin-only voice configuration settings are modified without operator.admin authorization

typescript

         }
 
         if (action === "set") {
+          // Persistent config writes require operator.admin for gateway clients.
+          // Without this check, a caller with only operator.write could bypass the
+          // admin-only config.patch RPC by reaching writeConfigFile indirectly
+          // through chat.send → /voice set.
+          if (ctx.channel === "webchat" && !ctx.gatewayClientScopes?.includes("operator.admin")) {
+            return { text: `⚠️ ${commandLabel} set requires operator.admin for gateway clients.` };
+          }
+
           const query = tokens.slice(1).join(" ").trim();
           if (!query) {
             return { text: `Usage: ${commandLabel} set <voiceId|name>` };

Source: GitHub Commit Update

Detection Methods for CVE-2026-41379

Indicators of Compromise

Unexpected configuration changes to voice settings in Talk Voice extension logs
Audit trail entries showing /voice set commands from operators without operator.admin scope
Configuration file modifications (writeConfigFile operations) initiated through the webchat channel by non-admin operators

Detection Strategies

Monitor authentication and authorization logs for operators invoking /voice set commands via the webchat gateway
Implement alerting on voice configuration changes that originate from sessions lacking operator.admin scope
Review audit logs for discrepancies between operator privilege levels and administrative configuration modifications

Monitoring Recommendations

Enable verbose logging for the Talk Voice extension to capture all /voice set command invocations
Configure SIEM rules to correlate chat.send activity with configuration write operations
Establish baseline behavior for operator activities and alert on privilege-exceeding actions

How to Mitigate CVE-2026-41379

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.28 or later immediately
Audit existing voice configurations for unauthorized modifications
Review operator accounts and remove unnecessary operator.write privileges where admin actions are not required
Monitor for any exploitation attempts using the detection strategies outlined above

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.28. The fix adds an explicit authorization check in the Talk Voice extension that verifies operator.admin scope for gateway clients attempting to use the /voice set command. For detailed patch information, refer to the GitHub Security Advisory and the GitHub Commit Update.

Workarounds

Restrict operator.write privileges to only trusted personnel who genuinely require write access
Disable or restrict access to the webchat gateway channel until the patch can be applied
Implement network-level access controls to limit which users can reach the chat.send endpoint

bash

# Configuration example - Restrict webchat gateway access
# In openclaw configuration, limit gateway client scopes
gateway:
  webchat:
    allowed_scopes:
      - "operator.read"
    # Remove operator.write for unprivileged operators until patched