CVE-2026-41225
Critical · 9.1CVSS
9.1
EPSS
0.5%
Published
May 13, 2026
CISA due date
—
The record
A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-54424 An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads… CWE-648
- CVE-2026-11877 An unauthorized user can modify configuration through API calls that affects the OpenText… CWE-648
- CVE-2026-9560 Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on… CWE-648
- CVE-2026-41386 OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap… CWE-648
- CVE-2026-41329 OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to… CWE-648
- CVE-2026-35669 OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in… CWE-648
- CVE-2026-35663 OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing… CWE-648
- GHSA-m5jp-p3r5-mfqp Duplicate Advisory: OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses… CWE-648