Описание
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice configuration persistence. Attackers with operator.write privileges can exploit the chat.send endpoint to reach and modify sensitive voice configuration settings intended for administrators only.
Ссылки
- Patch
- Vendor Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2026.3.28 (исключая)
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 15%
0.00243
Низкий
7.1 High
CVSS3
Дефекты
CWE-863
Связанные уязвимости
github
5 месяцев назад
OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send
EPSS
Процентиль: 15%
0.00243
Низкий
7.1 High
CVSS3
Дефекты
CWE-863