CVE-2026-42433 HIGH

CVE-2026-42433: OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

Vendor Openclaw
Product OpenClaw
Weakness CWE-862 · Missing authorization
Published May 5, 2026
Last update May 5, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner message-tool runs.

Key dates

02Disclosure timeline

May 5, 2026 CVE published
May 5, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-13935 Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion CVE-2025-23527 WordPress WC Wallet plugin <= 2.2.0 - Arbitrary Content Deletion vulnerability CVE-2025-31386 WordPress Simple:Press plugin <= 6.11.5 - Broken Access Control vulnerability CVE-2025-48346 WordPress Embed and Integrate Etsy Shop plugin <= 1.0.8 - Broken Access Control vulnerability CVE-2022-38684