Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-declared client metadata from WebSocket handshake rather than verified authorization state. Authenticated operator clients can spoof ACP identity labels and inject reserved provenance fields intended only for the ACP bridge by manipulating client metadata during connection.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41299 OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the chat.send gateway method where ACP-only provenance fields are gated by self-declared c… https://www.cve.org/CVERecord?id=CVE-2026-41299
Post summary
The tweet announces CVE-2026-41299, detailing an authorization bypass flaw in OpenClaw’s chat.send gateway, but provides no PoC, exploit, or patch information.
CVE-2026-41299 Authorization Bypass in OpenClaw Chat Gateway via Client Metadata Spoofing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41299
Post summary
The post announces CVE‑2026‑41299, describing it as an authorization bypass in OpenClaw caused by client metadata spoofing, but it provides no PoC, exploit code, or patch information.
A high-severity identity spoofing bypass (CVE-2026-41299) affects `OpenClaw` `Gateway` chat. This allows circumvention of provenance guards. Monitor vendor advisories for a fix. #OpenClaw #Security #CVE https://www.pulsepatch.io/posts/cve-2026-41299-openclaw-identity-spoofing-bypass
Post summary
The post reveals a high‑severity identity spoofing bypass (CVE‑2026‑41299) affecting OpenClaw Gateway chat, notes how provenance checks can be bypassed, and urges readers to watch vendor advisories for a forthcoming fix.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |