CVE-2026-41353

תיאור (מקור, אנגלית)

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profiles at runtime to access restricted profiles and bypass intended access controls.

מדדים

CVSS 3.1

8.1 (HIGH) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS 4.0

7.6 (HIGH) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-29/7/2026

CWE

CWE-472

מוצרים מושפעים

openclaw: openclaw

קישורים

• https://github.com/openclaw/openclaw/security/advisories/GHSA-h5hg-h7rr-gpf3 Vendor Advisory
• https://github.com/openclaw/openclaw/commit/eac93507c36ccd0c359fba18fa466ef644‮… Patch
• https://www.vulncheck.com/advisories/openclaw-allowprofiles-bypass-via-profile‮… Third Party Advisory