Openclaw cli: OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send (CVE-2026-41359)
Description
An authenticated user with operator.write privileges in the openclaw-cli package can escalate access to admin-level Telegram configuration and cron persistence settings via the send functionality. This vulnerability affects versions from 2026.1.29 up to but not including 2026.3.28. The issue has been addressed in version 2026.3.28 and later. The severity is rated as medium by maintainers, though the CVSS score is 7.1 (high).
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-41359 is a vulnerability in the openclaw-cli npm package where a user with operator.write permissions can reach admin-class Telegram configuration and cron persistence through the send function. This is an authenticated, sink-specific privilege escalation with a narrower scope than initially assessed. The vulnerability affects versions >=2026.1.29 and <2026.3.28. It was fixed in version 2026.3.28 by commit b7d70ade3b9900dbe97bd73be9c02e924ff3c986.
Potential Impact
An authenticated user with operator.write privileges can escalate their access to modify admin-level Telegram configuration and cron persistence settings. This could lead to unauthorized changes in critical configurations and persistence mechanisms. The impact is limited to authenticated users with specific permissions and does not allow unauthenticated exploitation.
Mitigation Recommendations
Upgrade openclaw-cli to version 2026.3.28 or later, where the vulnerability is fixed. No additional mitigation is required as the patch is officially released and available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-41359
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245a112601ec6a3165d8c
Added to database: 10/04/2026, 12:25:05 UTC
Last enriched: 10/04/2026, 12:48:57 UTC
Last updated: 10/04/2026, 16:08:38 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.