CVE-2026-41353: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41353 is an access control bypass vulnerability in the allowProfiles feature of OpenClaw, a Node.js browser proxy package. It allows low-privileged remote attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection, gaining unauthorized access to restricted browser proxy profiles. The vulnerability affects all OpenClaw (npm) versions up to and including 2026.3.13-1, with the fix shipped in version 2026.3.22. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.6 (High) (Github Advisory, OpenClaw Advisory). The vulnerability was published on April 23, 2026, and reported by researcher smaeljaish771, sponsored by KeenSecurityLab (OpenClaw Advisory).

The root cause is classified as CWE-472 (External Control of Assumed-Immutable Web Parameter): the allowProfiles allowlist was not enforced across all profile-targeting inputs — specifically, both query.profile and body.profile parameters in proxy requests were not consistently validated against the allowlist (Github Advisory). Additionally, the proxy did not block persistent profile mutation routes (POST /profiles/create and DELETE /profiles/{name}) when an allowlist was configured, allowing attackers to create or delete profiles at runtime and then select them to bypass restrictions (OpenClaw Advisory, Fix Commit). The fix introduced a dedicated request-policy.ts module that enforces allowlist checks on both query.profile and body.profile, and blocks profile create/delete routes whenever allowProfiles is set (Fix Commit). Exploitation requires low privileges (an authenticated session) and no user interaction, and is network-accessible.

Successful exploitation allows a low-privileged authenticated attacker to access restricted browser proxy profiles and the confidential data they contain, as well as modify profile state through unauthorized create or delete operations. The vulnerability has high confidentiality and integrity impact on the vulnerable system, with no availability impact (Github Advisory). Because the proxy exposes browser automation capabilities, unauthorized profile access could enable an attacker to interact with browser sessions, intercept sensitive browsing data, or pivot to other resources accessible through those profiles (OpenClaw Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.054% (17th percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation does require an attacker to have low-level authenticated access and specific deployment conditions (allowProfiles must be configured), which somewhat limits the attack surface.

1. Gain authenticated access: Obtain low-privileged credentials to an OpenClaw instance running a version ≤ 2026.3.13-1 with nodeHost.browserProxy.allowProfiles configured to restrict profile access.
2. Identify the proxy endpoint: Locate the node browser proxy API surface, typically accessible via the gateway's browser proxy routing.
3. Create a new persistent profile: Send a POST /profiles/create request through the proxy with a crafted body (e.g., {"name": "poc", "cdpUrl": "http://127.0.0.1:9222"}). In vulnerable versions, this route is not blocked even when allowProfiles is set, allowing the attacker to inject a new profile name into the system (Fix Commit).
4. Select the restricted profile at runtime: Issue a subsequent proxy request targeting a restricted profile by supplying it in the body.profile or query.profile parameter. Because the allowlist check was not applied to these fields in vulnerable versions, the request is forwarded without validation.
5. Access restricted profile data: With the bypass in place, interact with the restricted browser profile to read sensitive session data, intercept browser automation outputs, or perform unauthorized actions within that profile's context (OpenClaw Advisory).

• Network: Unexpected POST requests to /profiles/create or DELETE requests to /profiles/{name} on the OpenClaw browser proxy endpoint from low-privileged user accounts; requests containing profile parameters in both query strings and request bodies targeting profile names not in the configured allowProfiles list.
• Logs: OpenClaw proxy access logs showing profile creation or deletion events initiated by non-administrative users; log entries with query.profile or body.profile values referencing profiles outside the allowlist without triggering INVALID_REQUEST errors (indicating a pre-patch version).
• File System / Configuration: Unexpected new browser profile entries in the OpenClaw browser profiles configuration; profile names not matching the intended allowProfiles allowlist appearing in the active profile list.

Upgrade OpenClaw (npm package) to version 2026.3.22 or later, which enforces allowProfiles restrictions across both query.profile and body.profile parameters and blocks persistent profile create/delete routes when the allowlist is configured (OpenClaw Advisory, Fix Commit). As an interim measure, if upgrading immediately is not possible, consider disabling the node browser proxy entirely (nodeHost.browserProxy.enabled=false) or restricting network access to the proxy endpoint to trusted users only. After upgrading, audit the allowProfiles configuration to ensure only necessary profiles are listed and review logs for any signs of unauthorized profile access.

The Belgium Centre for Cybersecurity (CCB) issued a warning noting this vulnerability alongside other high-severity OpenClaw issues that could lead to RCE, advising immediate patching (CCB Advisory). The vulnerability was reported by researcher smaeljaish771 and sponsored by KeenSecurityLab, with the fix credited to maintainer steipete (OpenClaw Advisory). VulnCheck assigned the CVE and published an advisory describing the bypass mechanism (Github Advisory).