Which versions of OpenClaw are affected by CVE-2026-41353?

OpenClaw's Node browser proxy (versions ≤2026.3.13-1) contains a HIGH severity access control vulnerability (CVE-2026-41353) that allows authenticated users to bypass profile restrictions and access…. A patch is available.

How to fix or mitigate CVE-2026-41353?

Within 24 hours, identify and catalog all systems running OpenClaw Node browser proxy versions 2026.3.13-1 or earlier, noting any that manage sensitive or restricted browser profiles. Within 7 days, deploy vendor patch version 2026.3.22 across all affected systems, testing profile access controls in a non-production environment before production rollout. Within 30 days, complete production patching, verify all systems are running 2026.3.22 or later, and review access logs for the preceding 6 months to detect any unauthorized profile access attempts.

OpenClaw CVE-2026-41353

Q: What is the CVSS score of CVE-2026-41353?

CVE-2026-41353 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25337 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-04-23 VulnCheck

GHSA-jqm7-g5wf-cq4g

Authentication Bypass Openclaw

7.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable proxy with low complexity but requiring existing low-privilege access (PR:L); bypass yields high confidentiality and integrity impact over restricted profiles with no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 03:21 vuln.today

Analysis Generated

Jul 24, 2026 - 03:21 vuln.today

CVSS changed

Apr 23, 2026 - 22:28 NVD

8.1 (HIGH) 7.6 (HIGH)

EUVD ID Assigned

Apr 23, 2026 - 22:15 euvd

EUVD-2026-25337

Patch released

Apr 23, 2026 - 22:15 nvd

Patch available

CVE Published

Apr 23, 2026 - 21:58 nvd

HIGH 7.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 npm packages depend on openclaw (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.22.

DescriptionCVE.org

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profiles at runtime to access restricted profiles and bypass intended access controls.

AnalysisAI

Access control bypass in OpenClaw's Node browser proxy (all versions <= 2026.3.13-1, fixed in 2026.3.22) lets an authenticated remote attacker defeat the nodeHost.browserProxy.allowProfiles allowlist by mutating persistent profiles and selecting profiles at runtime, reaching browser profiles that were meant to be off-limits. Because the pre-fix proxy did not enforce the allowlist across the query.profile/body.profile selectors or block profile create/delete routes, an attacker with proxy access can target and manipulate restricted profiles. No public exploit identified at time of analysis, and EPSS is very low (0.04%, 13th percentile), but SSVC rates technical impact as total.

Technical ContextAI

OpenClaw is a Node.js application (npm package openclaw) whose node hosts advertise a browser proxy for driving browser automation profiles. The intended security boundary is nodeHost.browserProxy.allowProfiles, an optional allowlist that, when set, is supposed to enforce least-privilege access so only named profiles are reachable and persistent create/delete routes are blocked. The root cause aligns with CWE-472 (External Control of Assumed-Immutable Web Parameter): the proxy trusted client-supplied profile selectors (query.profile, body.profile, and an explicit profile parameter) and did not consistently re-validate them against the allowlist, and it left persistent profile create/delete routes exposed. The fix (commit eac93507c36ccd0c359fba18fa466ef6448be8a5) introduces src/browser/request-policy.ts with resolveRequestedBrowserProfile() to normalize the requested profile from all three sources and isPersistentBrowserProfileMutation() to identify and block POST /profiles/create and DELETE /profiles/{id} on the proxy surface when an allowlist is set.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.3.22 or later (npm openclaw@>=2026.3.22; the latest published release is 2026.3.31), which is the primary and complete fix (commit eac93507c36ccd0c359fba18fa466ef6448be8a5) and enforces the allowlist across query.profile and body.profile while blocking proxy-side profile create/delete. If you cannot upgrade immediately, reduce exposure by restricting network access to the node host browser proxy so only trusted operators can reach it, and by tightening the credentials that grant proxy access (this addresses the PR:L prerequisite); be aware that this does not restore the intended per-profile least-privilege boundary, so treat all configured profiles as reachable to anyone who can reach the proxy. Do not rely on allowProfiles as a security control on pre-2026.3.22 builds, since it can be bypassed. Full remediation guidance is in the GHSA advisory (https://github.com/openclaw/openclaw/security/advisories/GHSA-h5hg-h7rr-gpf3) and the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-allowprofiles-bypass-via-profile-mutation-and-runtime-selection).