OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 23, 2026 · NIST NVD

   Detected

   OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profiles at runtime to access restricted profiles and bypass intended access controls.

2. Jun 17, 2026 · NIST NVD

   Updated

   OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profiles at runtime to access restricted profiles and bypass intended access controls.

Affected

• cpe openclaw/openclawversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-41353

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-41353

  OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating bro

  nvd.nist.gov

References

• Patch · github.com
• Vendor Advisory · github.com
• Third Party Advisory · vulncheck.com