{"action":"Upgrade openclaw to 2026.3.28 or later.","affected":[{"fixed":"2026.3.28","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-41349"],"ecosystem":"npm","epss":0.00836,"exploited":false,"fixed_versions":["2026.3.28"],"ghsa_id":"GHSA-v3qc-wrwx-j3pw","id":"tcs_01M5KGAKXQAVY58F97XY4RBSMJ","modified_at":"2026-07-08T08:12:04.932898090Z","published_at":"2026-04-03T03:03:18Z","references":["https://osv.dev/vulnerability/GHSA-v3qc-wrwx-j3pw","https://github.com/openclaw/openclaw/security/advisories/GHSA-v3qc-wrwx-j3pw","https://github.com/openclaw/openclaw/commit/76411b2afc4ae721e36c12e0ea24fd23e2fed61e","https://github.com/openclaw/openclaw"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-v3qc-wrwx-j3pw","url":"https://osv.dev/vulnerability/GHSA-v3qc-wrwx-j3pw"}],"summary":"OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`"}