Vulnerability Description
OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profiles at runtime to access restricted profiles and bypass intended access controls.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.3.22 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/eac93507c36ccd0c359fba18fa466ef6448bPatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-h5hg-h7rr-gpf3Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-allowprofiles-bypass-via-profile-mThird Party Advisory
FAQ
What is CVE-2026-41353?
CVE-2026-41353 is a vulnerability with a CVSS score of 8.1 (HIGH). OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and ...
How severe is CVE-2026-41353?
CVE-2026-41353 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41353?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.