Ghostwire

CVE-2026-41353: OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows...

HIGH CVSS 8.1 2 PoC

Published: April 23, 2026 | Last Modified: April 23, 2026

Description

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profiles at runtime to access restricted profiles and bypass intended access controls.

Ghostwire Analysis — What This Means Practically

High CVSS score indicates significant risk — exploitation could lead to substantial data exposure or system compromise.
2 proof-of-concept exploits available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

CVE-2026-41353: OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows...

Description

Ghostwire Analysis — What This Means Practically

Proof-of-Concept Exploits (2)

Security Coverage (1 articles)

References