OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session rese…

OpenClaw before version 2026.3.28 contains a privilege escalation vulnerability in the chat.send function. The flaw allows write-scoped gateway callers to trigger admin-only session reset operations without proper authorization. Attackers can exploit improper authorization checks to rotate target sessions, archive transcript state, and force new session IDs. This vulnerability bypasses admin scope requirements and affects session management functionality. The issue has been identified and tracked under CVE-2026-41371.