{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-41359/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-41359"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenClaw"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","persistence","cve-2026-41359"],"_cs_type":"advisory","_cs_vendors":["OpenClaw"],"content_html":"\u003cp\u003eOpenClaw, in versions prior to 2026.3.28, is vulnerable to a privilege escalation. An authenticated operator with \u003ccode\u003eoperator.write\u003c/code\u003e credentials can leverage this vulnerability to access sensitive administrative functions. Specifically, the flaw resides in the \u003ccode\u003esend\u003c/code\u003e endpoint where insufficient access controls allow unauthorized modification of Telegram configurations and cron persistence settings, which are typically restricted to admin-level users. Successful exploitation allows an attacker to gain elevated privileges and control critical system configurations. This can lead to persistent backdoor access or manipulation of the bot's behavior.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains valid \u003ccode\u003eoperator.write\u003c/code\u003e credentials through legitimate access or credential compromise.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates to the OpenClaw instance.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious request to the \u003ccode\u003e/send\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe crafted request targets the Telegram configuration settings, bypassing access controls.\u003c/li\u003e\n\u003cli\u003eThe attacker modifies sensitive Telegram configurations, potentially redirecting communications or impersonating the admin.\u003c/li\u003e\n\u003cli\u003eThe attacker manipulates the cron persistence settings to execute arbitrary code at scheduled intervals.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a persistent backdoor, maintaining unauthorized access to the system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker with limited \u003ccode\u003eoperator.write\u003c/code\u003e privileges to gain administrative control over the OpenClaw instance. This could lead to unauthorized access to sensitive information, manipulation of the bot's functionality, or persistent backdoor access. The affected version is OpenClaw before 2026.3.28. There is no information about victim count or sectors targeted.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenClaw to version 2026.3.28 or later to patch CVE-2026-41359.\u003c/li\u003e\n\u003cli\u003eImplement the Sigma rule \u003ccode\u003eDetect OpenClaw Cron Persistence Modification\u003c/code\u003e to monitor for unauthorized changes to cron jobs.\u003c/li\u003e\n\u003cli\u003eImplement the Sigma rule \u003ccode\u003eDetect OpenClaw Telegram Configuration Modification\u003c/code\u003e to monitor for unauthorized changes to telegram configurations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-24T12:00:00Z","date_published":"2026-04-24T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-24-openclaw-privesc/","summary":"OpenClaw before 2026.3.28 contains a privilege escalation vulnerability that allows authenticated operators with write permissions to access and modify admin-class Telegram configuration and cron persistence settings via the send endpoint.","title":"OpenClaw Privilege Escalation via Telegram Configuration and Cron Persistence Settings","url":"https://feed.craftedsignal.io/briefs/2026-04-24-openclaw-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-41359","version":"https://jsonfeed.org/version/1.1"}