CVE-2026-41353: openclaw

csirt@kutim:~/threat-intel/cve/CVE-2026-41353

CVSS 8.1 · High EPSS 0,61%

Kerentanan External Control of Assumed-Immutable Web Parameter pada openclaw. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profiles at runtime to access restricted profiles and bypass intended access controls.

Rincian

Terbit di NVD: 23 April 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-472: External Control of Assumed-Immutable Web Parameter
EPSS (30 hari): 0,61% peluang dieksploitasi; lebih tinggi dari 47,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openclaw	openclaw	Semua versi sebelum 2026.3.22

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/openclaw/openclaw/security/advisories/GHSA-h5hg-h7rr-gpf3 advisory vendor
https://github.com/openclaw/openclaw/commit/eac93507c36ccd0c359fba18fa466ef6448be8a5 patch
https://www.vulncheck.com/advisories/openclaw-allowprofiles-bypass-via-profile-mutation-and-runtime-selection advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.