CVE-2026-41299
Published: 21 April 2026
Summary
CVE-2026-41299 is a high-severity Reliance on Untrusted Inputs in a Security Decision (CWE-807) vulnerability in Openclaw Openclaw. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-16 (Security and Privacy Attributes) and AC-25 (Reference Monitor).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to ACP-only provenance fields based on verified authorization state rather than untrusted self-declared client metadata in WebSocket handshakes.
Associates and protects security attributes such as ACP identity labels and provenance fields from spoofing by binding them to verified authorization, preventing unauthorized injection.
Implements a tamper-proof reference monitor to mediate and enforce access control policies in the chat.send gateway, blocking authorization bypass via manipulated client metadata.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authorization bypass in chat.send gateway allows authenticated operators to spoof ACP identity and inject privileged provenance fields, directly enabling exploitation of the software vulnerability for privilege escalation.
NVD Description
OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-declared client metadata from WebSocket handshake rather than verified authorization state. Authenticated operator clients can spoof ACP identity labels and…
more
inject reserved provenance fields intended only for the ACP bridge by manipulating client metadata during connection.
Deeper analysisAI
CVE-2026-41299 is an authorization bypass vulnerability (CWE-807) affecting OpenClaw versions before 2026.3.28. The issue resides in the chat.send gateway method, where ACP-only provenance fields are protected solely by self-declared client metadata from the WebSocket handshake, rather than the verified authorization state. This allows manipulation during connection establishment, with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), indicating network accessibility, low attack complexity, low privileges required, and primarily high integrity impact.
Authenticated operator clients can exploit this vulnerability by spoofing ACP identity labels and injecting reserved provenance fields meant exclusively for the ACP bridge. Attackers with operator-level access manipulate client metadata in the WebSocket handshake to bypass gates, enabling unauthorized injection of privileged data into chat.send operations.
Advisories recommend upgrading to OpenClaw 2026.3.28 or later to mitigate the issue, as detailed in the GitHub Security Advisory (GHSA-6xg4-82hv-cp6f) and VulnCheck advisory on client identity spoofing in chat.send gateway provenance guards.
Details
- CWE(s)