OpenClaw before 2026.3.28 suffers from a privilege escalation flaw that allows authenticated users with operator.write permissions to access and modify admin‑class Telegram configuration and cron persistence settings through the send endpoint. This weakness, identified as CWE‑269, removes access controls that should confine those settings to higher‑privileged roles. The result is that an attacker who has any operator write capability can elevate privileges to administer cron jobs and potentially persist malicious changes, compromising the integrity and availability of the system.

The vulnerability affects OpenClaw deployments running any version before 2026.3.28. Administrators should verify whether their environment uses a pre‑2026.3.28 release of the OpenClaw application.

The CVSS score of 7.1 indicates a high severity issue. The EPSS score of less than 1% shows that current exploitation likelihood is very low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need legitimate operator.write credentials and would exploit the insufficient access control on the send endpoint to reach the admin configuration resources. Because access to the operator.write role is usually restricted, the overall risk is moderate, but the impact of compromising cron persistence is significant.