OpenClaw Access Control Bypass Vulnerability

OpenClaw, a software application, is vulnerable to an access control bypass (CVE-2026-41353) affecting versions prior to 2026.3.22. This vulnerability resides in the allowProfiles feature, enabling attackers to bypass intended access controls. The exploitation involves manipulating browser proxy profiles at runtime through persistent profile mutation and runtime profile selection. This allows remote attackers to gain access to restricted profiles. This poses a significant risk to environments relying on OpenClaw for profile-based access control, as it can lead to unauthorized data access and privilege escalation. This vulnerability was published on April 23, 2026.

Attack Chain

1. Attacker gains initial access to a system with OpenClaw installed.
2. The attacker identifies the targeted restricted profile.
3. Attacker exploits the allowProfiles feature by persistently mutating the profile configuration.
4. The attacker manipulates browser proxy profiles at runtime to bypass access controls.
5. The attacker selects the restricted profile during runtime.
6. OpenClaw incorrectly authorizes the attacker, granting access to the restricted profile.
7. Attacker leverages the unauthorized access to perform privileged actions.

Impact

Successful exploitation of this vulnerability allows attackers to bypass intended access controls and gain unauthorized access to restricted profiles within OpenClaw. This can lead to the compromise of sensitive information, privilege escalation, and potential disruption of services. The impact is significant for organizations relying on OpenClaw for access control, as it undermines the security measures intended to protect sensitive resources.

Recommendation

• Upgrade OpenClaw to version 2026.3.22 or later to patch CVE-2026-41353.
• Implement the following Sigma rule to detect potential exploitation attempts by monitoring for profile manipulation.
• Monitor OpenClaw logs for suspicious profile changes or runtime profile selections indicative of exploitation.