Description (CNA)
OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter. Remote attackers can exploit this to bypass security controls and execute unauthorized operations without user consent.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenClaw / OpenClaw | affected 0 before 2026.3.28; unaffected 2026.3.28 |
CWE
CWE-862
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-v3qc-wrwx-j3pw
- https://github.com/openclaw/openclaw/commit/76411b2afc4ae721e36c12e0ea24fd23e2fed61e
- https://www.vulncheck.com/advisories/openclaw-agentic-consent-bypass-via-config-patch
ADP enrichment
No English description supplied.
No references supplied.