OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes

CAO 7.1CVE-2026-32972 · GHSA-vmhq-cqm9-6p7q · Công bố 29/03/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-32972 là lỗ hổng mức CAO (CVSS 7.1) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.29%, cao hơn 22.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.3.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`< 2026.3.11`	`2026.3.11`
openclaw npm	`< 2026.3.11`	`2026.3.11`

Mô tả

Summary

An authorization mismatch in the gateway let an authenticated caller with only operator.write use browser.request to reach browser profile management routes that persist configuration to disk. In practice, this exposed an admin-only configuration write primitive through /profiles/create.

Impact

A write-scoped operator could create or modify browser profiles and store attacker-chosen remote CDP endpoints without holding operator.admin.

Affected versions

openclaw <= 2026.3.8

Patch

Fixed in openclaw 2026.3.11 and included in later releases such as 2026.3.12. Browser profile creation now requires the correct admin boundary, and regression tests cover the write-vs-admin authorization split.

Mô tả của NVD

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile management routes through browser.request. Attackers can create or modify browser profiles and persist attacker-controlled remote CDP endpoints to disk without holding operator.admin privileges.