CVE-2026-42433 OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools
Attackers can modify persistent Matrix profile configurations via operator.write tools without admin authority, requiring an upgrade to OpenClaw.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42433?
CVE-2026-42433 is a high-severity missing authorization vulnerability in OpenClaw, published on 5 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner message-tool runs.
Weakness: CWE-862
Which versions are affected by CVE-2026-42433?
2 open source packages ship an affected version, including openclaw.
| Package | Affected | Fixed in |
|---|---|---|
openclaw npm | All versions | 2026.4.10 |
openclaw npm | All versions | 2026.4.10 |
How do I fix CVE-2026-42433?
Upgrade openclaw to 2026.4.10 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-42433 being exploited?
There is no known exploitation of CVE-2026-42433 in the wild and no public exploit code.
Sources
Also known as GHSA-7jp6-r74r-995q, MINI-85qq-6x96-77cx.