Executive brief
OpenClaw is an AI automation platform that performs tasks across operating systems and applications. An authorization flaw allows authenticated users with limited "write" permissions to create or modify sensitive browser profiles—a capability restricted to administrators—and inject malicious remote endpoints into the system. This could enable attackers to intercept or manipulate browser automation activities and bypass access controls.
Technical details
An authorization mismatch in the gateway fails to properly enforce privilege boundaries when processing browser.request API calls. An authenticated user holding only operator.write permissions can invoke the /profiles/create endpoint, which persists admin-scoped browser profile configuration to disk. The vulnerability stems from insufficient privilege checking: the browser.request route checks for operator.write but does not verify the stricter operator.admin permission required for profile persistence. An attacker can create or modify browser profiles and set arbitrary remote Chrome DevTools Protocol (CDP) endpoints without admin privileges. The flaw was patched in version 2026.3.11 by enforcing the correct admin boundary and adding regression tests for the write-vs-admin authorization split (CWE-863).
Affected products
- OpenClaw OpenClaw <= 2026.3.8
Timeline
- 2026-03-13: disclosed: Advisory GHSA-vmhq-cqm9-6p7q published
- 2026-03-11: patched: Fixed in version 2026.3.11