CVE-2026-35653: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35653 is an incorrect authorization vulnerability (CWE-863) in OpenClaw, a Node.js-based multi-channel AI gateway, affecting all versions up to and including 2026.3.22. The flaw exists in the POST /reset-profile endpoint, which can be reached by authenticated callers holding only operator.write access to the browser.request surface — a lower-privilege level than intended for profile mutation operations. It was disclosed on April 10, 2026, with a fix released in version 2026.3.24. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is an incomplete implementation of the isPersistentBrowserProfileMutation() route classifier in src/browser/request-policy.ts. This helper function, used to gate destructive profile operations, correctly blocks POST /profiles/create and DELETE /profiles/:name, but omits POST /reset-profile from its classification logic. As a result, when a caller invokes browser.request on the operator.write surface with method: "POST" and path: "/reset-profile", the request bypasses the mutation gate and is forwarded directly to resetProfile() in src/browser/server-context.reset.ts. The same classification helper is reused in both src/gateway/server-methods/browser.ts and src/node-host/invoke-browser.ts, meaning both code paths are vulnerable. This is classified as a residual/incomplete fix relative to the earlier advisory GHSA-vmhq-cqm9-6p7q (GitHub Advisory).

An authenticated attacker with operator.write access to browser.request can trigger destructive profile-management operations that cross intended privilege boundaries. Specifically, exploitation causes the running browser for the targeted profile to stop, closes the associated Playwright browser connection, and moves the profile's local userDataDir to Trash if it exists on disk. This results in high integrity and availability impact — persistent browser state is destroyed and service continuity is disrupted — though there is no confidentiality impact as no data is exposed to the attacker (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, providing step-by-step reproduction instructions including exact HTTP method, path, and body parameters. The advisory was assessed with high confidence as a real exploit. No in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.038%, reflecting low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Authenticate: Obtain credentials for an account with operator.write access to the browser.request Gateway method on an OpenClaw instance running version <= 2026.3.22.
2. Verify control case (optional): Call browser.request with method: "POST", path: "/profiles/create", body: { "name": "poc-profile" } and confirm the request is rejected with the error browser.request cannot create or delete persistent browser profiles. This confirms the partial gate is active.
3. Identify target profile: Confirm the existence of a target persistent browser profile (e.g., poc-profile) on the OpenClaw instance.
4. Send exploit request: Call browser.request with method: "POST", path: "/reset-profile", body: { "profile": "poc-profile", "name": "poc-profile" }.
5. Observe bypass: The request is not intercepted by isPersistentBrowserProfileMutation() and is forwarded to the browser route dispatcher.
6. Achieve impact: The resetProfile() function executes — stopping the running browser for the profile, closing the Playwright connection, and moving the profile's userDataDir to Trash — without requiring elevated operator.admin privileges (GitHub Advisory).

• Network: Authenticated HTTP POST requests to /reset-profile originating from accounts that hold only operator.write (not operator.admin) permissions; unexpected browser.request Gateway calls with path: "/reset-profile" in API access logs.
• Logs: OpenClaw gateway logs showing browser.request invocations with POST /reset-profile that were not rejected by the mutation classifier; log entries from resetProfile() indicating browser stop and Playwright connection closure.
• File System: Profile userDataDir directories unexpectedly moved to the system Trash/Recycle Bin; missing or relocated browser profile data directories under the OpenClaw state directory.
• Process: Unexpected termination of Playwright browser processes associated with managed profiles; browser child processes exiting without a corresponding administrative action (GitHub Advisory).

The recommended remediation is to upgrade OpenClaw to version 2026.3.24 or later, which extends the isPersistentBrowserProfileMutation() classifier to include POST /reset-profile and adds regression test coverage for the denied route. Patches are available at commits 4dcc39c and e7d11f6 in the OpenClaw repository. As an interim workaround, restrict operator.write access to browser.request to only fully trusted service accounts, and implement network-level access controls to limit which clients can reach the OpenClaw Gateway. Additionally, audit all nearby profile-management routes for other state-changing endpoints that may be missing from the mutation classifier (GitHub Advisory).

The advisory was published by maintainer steipete on GitHub and credited researcher tdjackey as the reporter. The vulnerability was assigned by VulnCheck and tracked as EUVD-2026-21452 in the ENISA European Vulnerability Database. Coverage appeared on automated security aggregators including RedPacket Security and The Hacker Wire shortly after disclosure, and a Bluesky post from cyberhub.blog noted the advisory. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified.