CVE-2026-41299

BRIEFING NOTE: CVE-2026-41299 OpenClaw versions prior to 2026.3.28 contain an authorization bypass vulnerability in the chat.send gateway method. The flaw permits authenticated operator clients to spoof access control proxy (ACP) identity labels by manipulating self-declared client metadata during WebSocket handshake, allowing injection of reserved provenance fields intended exclusively for ACP bridge communication. The vulnerability carries a CVSS 3.1 severity rating of 7.1 (HIGH) with a network-based attack vector requiring low complexity and authenticated access. While confidentiality impact is limited, integrity compromise is rated high, enabling attackers to inject falsified provenance data. The EPSS score of 0.00048 indicates this vulnerability is less prevalent in the broader CVE landscape. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. Community attention appears minimal at this time. Organizations running affected versions should prioritize upgrading to version 2026.3.28 or later to mitigate the authorization bypass risk.