{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/agentic-consent-bypass/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-41349"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenClaw"],"_cs_severities":["high"],"_cs_tags":["cve-2026-41349","agentic consent bypass","llm"],"_cs_type":"advisory","_cs_vendors":["OpenClaw"],"content_html":"\u003cp\u003eOpenClaw, a framework for building LLM agents, is vulnerable to an agentic consent bypass. Specifically, versions prior to 2026.3.28 are susceptible to CVE-2026-41349, where an LLM agent can silently disable execution approval through manipulation of the \u003ccode\u003econfig.patch\u003c/code\u003e parameter. This vulnerability allows remote attackers to bypass security controls that are meant to ensure user consent before executing operations. The vulnerability was reported on April 23, 2026. Successful exploitation could lead to unauthorized actions being performed by the LLM agent without the user's knowledge or permission, undermining the intended security model of OpenClaw.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to an OpenClaw instance or application using it, potentially through compromised credentials or by exploiting another vulnerability.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious \u003ccode\u003econfig.patch\u003c/code\u003e parameter designed to disable execution approval.\u003c/li\u003e\n\u003cli\u003eThe attacker injects the crafted \u003ccode\u003econfig.patch\u003c/code\u003e into the OpenClaw configuration, exploiting the vulnerability.\u003c/li\u003e\n\u003cli\u003eThe OpenClaw application processes the modified configuration, effectively bypassing consent checks.\u003c/li\u003e\n\u003cli\u003eThe LLM agent, now operating without consent requirements, initiates unauthorized actions.\u003c/li\u003e\n\u003cli\u003eThese unauthorized actions can include data exfiltration, system modification, or other malicious activities depending on the LLM agent's capabilities.\u003c/li\u003e\n\u003cli\u003eThe attacker monitors the LLM agent's activities, leveraging its capabilities for further malicious purposes.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to bypass intended security controls and execute unauthorized operations. The severity of impact depends on the privileges and capabilities granted to the LLM agent. In a worst-case scenario, an attacker could gain complete control over systems accessible to the LLM agent, leading to significant data breaches, system compromise, or financial loss. While the exact number of affected organizations is unknown, any deployment of OpenClaw before version 2026.3.28 is potentially vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenClaw to version 2026.3.28 or later to remediate CVE-2026-41349.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for unexpected modifications to the OpenClaw configuration, especially those involving the \u003ccode\u003econfig.patch\u003c/code\u003e parameter. Deploy the Sigma rule \u003ccode\u003eDetect OpenClaw Config Patch Manipulation\u003c/code\u003e to detect such modifications.\u003c/li\u003e\n\u003cli\u003eReview and restrict the permissions granted to LLM agents to minimize the potential impact of unauthorized actions.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for suspicious activity originating from OpenClaw instances. Use the IOC information provided by VulnCheck's advisory for threat hunting.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-24T12:00:00Z","date_published":"2026-04-24T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-24-openclaw-bypass/","summary":"OpenClaw before version 2026.3.28 contains an agentic consent bypass vulnerability (CVE-2026-41349) that allows LLM agents to silently disable execution approval via the config.patch parameter, potentially enabling remote attackers to bypass security controls and execute unauthorized operations without user consent.","title":"OpenClaw Agentic Consent Bypass Vulnerability (CVE-2026-41349)","url":"https://feed.craftedsignal.io/briefs/2026-04-24-openclaw-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Agentic Consent Bypass","version":"https://jsonfeed.org/version/1.1"}