CVE-2026-41344
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Apr 23, 2026
Vendor
unknown
Description
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verboseLevel session overrides. Attackers can exploit the /verbose parameter to bypass access controls and expose sensitive reasoning or tool output intended to be restricted to administrators.