CVE-2026-35653: OpenClaw auth bypass enables agent

CISO Take

OpenClaw before 2026.3.24 contains a broken authorization flaw (CWE-863) where any authenticated user holding operator.write access to browser.request can invoke POST /reset-profile — an action reserved for higher-privilege contexts — stopping the running browser, terminating all Playwright connections, and moving the agent profile directory to Trash. With CVSS 8.1 (AV:N/AC:L/PR:L/UI:N), this is trivially exploitable by any insider or attacker who compromises a low-privilege service account, with total integrity and availability impact on the affected agent session. Downstream exposure is limited (4 tracked dependents), no active exploitation is recorded in CISA KEV, and no public exploit currently exists. Teams running OpenClaw should patch to 2026.3.24 or later using the referenced commits, audit operator.write grants, and alert on POST /reset-profile calls from non-admin principals in application logs.

Sources: NVD GitHub Advisory ATLAS VulnCheck

What is the risk?

High operational risk for any organization running OpenClaw in production AI agent deployments. The attack requires only low-privilege authenticated access and is network-reachable with no user interaction, making it accessible to malicious insiders or attackers holding compromised service account credentials. The primary risk is operational disruption — complete termination of browser-driven agent sessions and profile data destruction — rather than data exfiltration. The small tracked dependency footprint (4 dependents) limits broad blast radius, but any enterprise using OpenClaw for agentic browser automation should treat this as urgent patching priority.

How does the attack unfold?

Initial Access

Attacker obtains valid credentials for an account with operator.write access to browser.request, via insider access, credential theft from a CI/CD pipeline, or harvesting via malicious skills.

AML.T0012

Exploitation

Attacker sends an authenticated POST request to /reset-profile via the browser.request surface, bypassing the intended authorization check due to CWE-863.

AML.T0049

Agent Disruption

OpenClaw stops the running browser and terminates all Playwright connections, halting all in-progress browser-automation AI agent tasks and destroying session state.

AML.T0029

Data Destruction

Agent profile directory is moved to Trash, permanently destroying stored session credentials, cookies, and task context and requiring manual recovery to restore agent operations.

AML.T0101

Initial Access

Attacker obtains valid credentials for an account with operator.write access to browser.request, via insider access, credential theft from a CI/CD pipeline, or harvesting via malicious skills.

AML.T0012

Exploitation

Attacker sends an authenticated POST request to /reset-profile via the browser.request surface, bypassing the intended authorization check due to CWE-863.

AML.T0049

Agent Disruption

OpenClaw stops the running browser and terminates all Playwright connections, halting all in-progress browser-automation AI agent tasks and destroying session state.

AML.T0029

Data Destruction

Agent profile directory is moved to Trash, permanently destroying stored session credentials, cookies, and task context and requiring manual recovery to restore agent operations.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

5 steps

Patch immediately to OpenClaw 2026.3.24 or later (commits e7d11f6c and 4dcc39c2 referenced in the advisory address the authorization logic).
Audit all accounts holding operator.write access to browser.request and restrict to least-privilege principals.
Configure WAF or application-layer rules to block POST /reset-profile calls from non-admin source roles or IPs.
Monitor application and access logs for unexpected POST /reset-profile requests — any call from a non-admin account should trigger an immediate alert.
For unpatched deployments, consider disabling the /reset-profile endpoint at the reverse-proxy level until patching is complete.

How is it classified?

Auth Bypass DoS Agent AML.T0012 - Valid Accounts AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0101 - Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1 - Access control

NIST AI RMF

GOVERN 1.2 - Policies and practices define and differentiate roles for human-AI teams

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35653?

OpenClaw before 2026.3.24 contains a broken authorization flaw (CWE-863) where any authenticated user holding operator.write access to browser.request can invoke POST /reset-profile — an action reserved for higher-privilege contexts — stopping the running browser, terminating all Playwright connections, and moving the agent profile directory to Trash. With CVSS 8.1 (AV:N/AC:L/PR:L/UI:N), this is trivially exploitable by any insider or attacker who compromises a low-privilege service account, with total integrity and availability impact on the affected agent session. Downstream exposure is limited (4 tracked dependents), no active exploitation is recorded in CISA KEV, and no public exploit currently exists. Teams running OpenClaw should patch to 2026.3.24 or later using the referenced commits, audit operator.write grants, and alert on POST /reset-profile calls from non-admin principals in application logs.

Is CVE-2026-35653 actively exploited?

No confirmed active exploitation of CVE-2026-35653 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35653?

1. Patch immediately to OpenClaw 2026.3.24 or later (commits e7d11f6c and 4dcc39c2 referenced in the advisory address the authorization logic). 2. Audit all accounts holding operator.write access to browser.request and restrict to least-privilege principals. 3. Configure WAF or application-layer rules to block POST /reset-profile calls from non-admin source roles or IPs. 4. Monitor application and access logs for unexpected POST /reset-profile requests — any call from a non-admin account should trigger an immediate alert. 5. For unpatched deployments, consider disabling the /reset-profile endpoint at the reverse-proxy level until patching is complete.

What systems are affected by CVE-2026-35653?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser automation pipelines, computer-use AI systems, agentic AI workflows.

What is the CVSS score for CVE-2026-35653?

CVE-2026-35653 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.60%.

What is the AI security impact?

Affected AI Architectures

agent frameworksbrowser automation pipelinescomputer-use AI systemsagentic AI workflows

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0101 Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the browser.request surface to stop the running browser, close Playwright connections, and move profile directories to Trash, crossing intended privilege boundaries.

Exploitation Scenario

An attacker compromises a low-privilege CI/CD service account or insider account with operator.write access in an enterprise running OpenClaw for automated browser-based AI agent tasks. They send a crafted authenticated POST request to /reset-profile via the browser.request surface, bypassing the intended privilege check. OpenClaw immediately stops the running browser, closes all active Playwright connections — terminating any ongoing AI agent web automation tasks — and moves the agent profile directory to Trash, destroying session state, stored credentials, and task context. The AI agent pipeline halts entirely, requiring manual intervention. In a targeted attack, this could be chained with the credential-harvesting technique documented in AIID #1368 (malicious OpenClaw skills delivering AMOS stealer) to first exfiltrate operator.write credentials and then destroy the agent environment to disrupt incident response.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.