OpenClaw: High-Severity Access Control Bypass Looms

The National Vulnerability Database (NVD) has detailed CVE-2026-41353, a high-severity access control bypass vulnerability in OpenClaw versions prior to 2026.3.22. This flaw, rated 8.1 CVSS, allows remote attackers to circumvent intended profile restrictions within the allowProfiles feature. The mechanism involves persistent profile mutation and runtime profile selection, enabling attackers to manipulate browser proxy profiles.

Attackers can exploit this by dynamically altering proxy profiles during runtime, gaining unauthorized access to restricted configurations. This effectively bypasses the security controls designed to segineate and protect specific user or system profiles. The implications are significant: an attacker could force a browser into a compromised state, potentially rerouting traffic or accessing sensitive internal resources.

This vulnerability highlights a critical design flaw where runtime manipulation can override static policy. Defenders should recognize that sophisticated attackers frequently target such logical bypasses. It’s not about brute force; it’s about understanding how policy enforcement can be subverted when state changes dynamically.