HIGH 7.1 npm
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
GHSA-767m-xrhc-fxm7 · CVE-2026-41359
Published · Modified
Description
Summary
Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: Real shipped operator.write to admin-class Telegram config or cron persistence bug, but it is an authenticated sink-specific escalation and high is too high given the narrower scope.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.24 - Patched versions:
>= 2026.3.28 - First stable tag containing the fix:
v2026.3.28
Fix Commit(s)
b7d70ade3b9900dbe97bd73be9c02e924ff3c986— 2026-03-25T12:12:09-06:00
Release Process Note
- The fix is already present in released version
2026.3.28. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.
Thanks @zpbrent for reporting.
References
- WEB https://github.com/openclaw/openclaw/security/advisories/GHSA-767m-xrhc-fxm7
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-41359
- WEB https://github.com/openclaw/openclaw/commit/b7d70ade3b9900dbe97bd73be9c02e924ff3c986
- PACKAGE https://github.com/openclaw/openclaw
- WEB https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-operator-write-to-admin-class-telegram-config-and-cron-persistence
Ready to move
Start Securing
Free, no credit card | First findings in minutes