{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-41353/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-41353"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenClaw"],"_cs_severities":["high"],"_cs_tags":["access-control","bypass","openclaw","cve-2026-41353"],"_cs_type":"advisory","_cs_vendors":["OpenClaw"],"content_html":"\u003cp\u003eOpenClaw, a software application, is vulnerable to an access control bypass (CVE-2026-41353) affecting versions prior to 2026.3.22. This vulnerability resides in the \u003ccode\u003eallowProfiles\u003c/code\u003e feature, enabling attackers to bypass intended access controls. The exploitation involves manipulating browser proxy profiles at runtime through persistent profile mutation and runtime profile selection. This allows remote attackers to gain access to restricted profiles. This poses a significant risk to environments relying on OpenClaw for profile-based access control, as it can lead to unauthorized data access and privilege escalation. This vulnerability was published on April 23, 2026.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to a system with OpenClaw installed.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the targeted restricted profile.\u003c/li\u003e\n\u003cli\u003eAttacker exploits the \u003ccode\u003eallowProfiles\u003c/code\u003e feature by persistently mutating the profile configuration.\u003c/li\u003e\n\u003cli\u003eThe attacker manipulates browser proxy profiles at runtime to bypass access controls.\u003c/li\u003e\n\u003cli\u003eThe attacker selects the restricted profile during runtime.\u003c/li\u003e\n\u003cli\u003eOpenClaw incorrectly authorizes the attacker, granting access to the restricted profile.\u003c/li\u003e\n\u003cli\u003eAttacker leverages the unauthorized access to perform privileged actions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows attackers to bypass intended access controls and gain unauthorized access to restricted profiles within OpenClaw. This can lead to the compromise of sensitive information, privilege escalation, and potential disruption of services. The impact is significant for organizations relying on OpenClaw for access control, as it undermines the security measures intended to protect sensitive resources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenClaw to version 2026.3.22 or later to patch CVE-2026-41353.\u003c/li\u003e\n\u003cli\u003eImplement the following Sigma rule to detect potential exploitation attempts by monitoring for profile manipulation.\u003c/li\u003e\n\u003cli\u003eMonitor OpenClaw logs for suspicious profile changes or runtime profile selections indicative of exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-23T22:16:42Z","date_published":"2026-04-23T22:16:42Z","id":"https://feed.craftedsignal.io/briefs/2026-04-23-openclaw-bypass/","summary":"OpenClaw before 2026.3.22 allows attackers to circumvent profile restrictions via persistent profile mutation and runtime profile selection, leading to unauthorized access.","title":"OpenClaw Access Control Bypass Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-04-23-openclaw-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-41353","version":"https://jsonfeed.org/version/1.1"}