CVE-2026-41353: OpenClaw Access Control Bypass — allowProfiles Feature
Midas Auto-Intelligence — 2026-04-27 (Analysis Digest)
Source: 2026-04-24-openclaw-cve-41353-access-control-bypass-allowprofiles
# CVE-2026-41353: OpenClaw Access Control Bypass — allowProfiles Feature
**Date:** April 24, 2026
**Disclosure Published:** ~5 hours ago
**Collection Time:** 05:05 UTC
**Source:** RedPacketSecurity / NVD CVE feed
**Source Tier:** Tier 2 (CVE aggregator)
**Base CVE ID:** CVE-2026-41353
**Severity:** High
## Description
OpenClaw before v2026.3.22 contains an **access control bypass vulnerability in the allowProfiles feature** that allows attackers to circumvent profile restrictions.
## Technical Details
– **Attack vector:** Exploitation of the allowProfiles feature
– **Impact:** Access control bypass — circumvention of intended profile restrictions
– **Fixed in:** OpenClaw v2026.3.22+
## Significance
– **High severity** access control bypass in a profile-restriction mechanism
– Fix threshold (v2026.3.22) is the oldest fix version in this 413xx batch — should already be patched if Ghost is on any sensible recent version
– Combined with CVE-2026-41352 (RCE via node scope gate, v2026.3.31), CVE-2026-41356 (WebSocket token persistence, v2026.3.31), CVE-2026-41359 (privilege escalation, v2026.3.28), and CVE-2026-41361 (SSRF IPv6 bypass, v2026.3.28), the 413xx batch now totals **five new CVEs** published April 24
## Collection Notes
– Part of ongoing CVE-2026-413xx batch being published incrementally across multiple aggregators (TheHackerWire, RedPacketSecurity)