{"action":"Upgrade openclaw to 2026.3.28 or later.","affected":[{"fixed":"2026.3.28","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-41371"],"ecosystem":"npm","epss":0.00255,"exploited":false,"fixed_versions":["2026.3.28"],"ghsa_id":"GHSA-5r8f-96gm-5j6g","id":"tcs_01M5KF4H1QA2WXRPMP9P752ZSK","modified_at":"2026-07-08T07:35:42.338088043Z","published_at":"2026-04-01T00:00:34Z","references":["https://osv.dev/vulnerability/GHSA-5r8f-96gm-5j6g","https://github.com/openclaw/openclaw/security/advisories/GHSA-5r8f-96gm-5j6g","https://github.com/openclaw/openclaw/commit/be00fcfccba108f88dc3d4380146c6e058770b03","https://github.com/openclaw/openclaw","https://github.com/openclaw/openclaw/releases/tag/v2026.3.28"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-5r8f-96gm-5j6g","url":"https://osv.dev/vulnerability/GHSA-5r8f-96gm-5j6g"}],"summary":"OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`"}