Dashboard / CVE-2026-41359

CVE-2026-41359

HIGH
MEDIUM Priority: 0.02 BB Relevance: 64/100
Published: 2026-04-23 Modified: 2026-11-11 First seen: 2026-11-11 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: Low
VI: High
VA: None

Description

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Telegram configuration and cron persistence settings via the send endpoint. Attackers with operator.write credentials can exploit insufficient access controls to reach sensitive administrative functionality and modify persistence mechanisms.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
openclaw openclaw < 2026.3.28

References & Advisories (3)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.23%
Raw Score 0.002320
Percentile 14.1%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00232
2026-11-12
0.00232
2026-11-10
0.00232

Intelligence Sources

nvd ref →

External Links