CVE-2026-35653

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the browser.request surface to stop the running browser, close Playwright connections, and move profile directories to Trash, crossing intended privilege boundaries.

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the browser.request surface to stop the running browser, close Playwright connections, and move profile directories to Trash, crossing intended privilege boundaries.

Fixed in OpenClaw 2026.3.24, the current shipping release.

Title

browser.request still allows POST /reset-profile through the operator.write surface in OpenClaw v2026.3.22 after GHSA-vmhq-cqm9-6p7q

Severity Assessment

High

CWE:

• CWE-863: Incorrect Authorization

Proposed CVSS v3.1:

• 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)

An authenticated caller who only has access to the scoped Gateway method browser.request on the operator.write surface can still reach a destructive persistent-profile management route.

Likely related advisory family:

• GHSA-vmhq-cqm9-6p7q

This should be treated as a later-version residual or incomplete fix. The earlier fix blocked POST /profiles/create and profile deletion, but the latest released v2026.3.22 code still omits POST /reset-profile from the same mutation gate.

Impact

A caller with operator.write access to browser.request can still trigger persistent profile reset via POST /reset-profile.

This crosses the intended privilege boundary for browser profile management because the release already attempts to block adjacent persistent profile mutations on this same surface.

In practice, the allowed route reaches destructive behavior that can:

• stop the running browser for that profile
• close the Playwright browser connection for that profile
• move the profile's local userDataDir to Trash when it exists

This is a real integrity and availability impact on persistent browser state, not a route-classification mismatch with no side effects.

Affected Component

Product:

• openclaw

Tested latest released version:

• release tag: v2026.3.22
• release tag target commit (peeled tag): e7d11f6c33e223a0dd8a21cfe01076bd76cef87a

Published artifact for that release:

• package: openclaw-2026.3.22.tgz
• package build-info commit: 4dcc39c25c6cc63fedfd004f52d173716576fcf0
• package build-info timestamp: 2026-03-23T10:56:05.946Z

Exact vulnerable paths on the shipped tag:

• src/gateway/method-scopes.ts:114
  • browser.request is placed on the operator.write surface
• src/gateway/server-methods/browser.ts:155-165
  • requests are only denied when isPersistentBrowserProfileMutation(method, path) returns true
• src/browser/request-policy.ts:19-25
  • the mutation classifier recognizes POST /profiles/create and DELETE /profiles/:name, but not POST /reset-profile
• src/browser/routes/basic.ts:161-170
  • the browser server exposes POST /reset-profile
• src/browser/server-context.reset.ts:37-63
  • resetProfile() stops the browser, closes the connection, and moves the local profile directory to Trash when present
• src/node-host/invoke-browser.ts:240-243
  • the same route-classification helper is reused in the browser proxy path when profile restrictions are active

Relevant regression coverage gap on the shipped tag:

• src/gateway/server-methods/browser.profile-from-body.test.ts:104-140
  • tests only block POST /profiles/create and DELETE /profiles/:name
  • there is no equivalent deny case for POST /reset-profile

Published artifact evidence for the exact released package:

• openclaw-2026.3.22.tgz::package/dist/build-info.json
• openclaw-2026.3.22.tgz::package/dist/gateway-cli-Cxz4pSoJ.js:11469-11525
• openclaw-2026.3.22.tgz::package/dist/gateway-cli-Cxz4pSoJ.js:11484-11485
• openclaw-2026.3.22.tgz::package/dist/request-policy-nIRryZwZ.js:9-12
• openclaw-2026.3.22.tgz::package/dist/routes-CdaHRCET.js:6874-6889

Important release note:

• the published package build-info commit differs from the release tag target commit
• for this issue, the relevant authorization and route behavior was cross-checked in both the shipped tag source and the published package bundle, and it matches semantically on the vulnerable path

Technical Reproduction

A direct control/exploit pair can be reproduced against the latest released version.

Preconditions:

• use [email protected] -…

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the browser.request surface to stop the running browser, close Playwright connections, and move profile directories to Trash, crossing intended privilege boundaries.

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the browser.request surface to stop the running browser, close Playwright connections, and move profile directories to Trash, crossing intended privilege boundaries.

Fixed in OpenClaw 2026.3.24, the current shipping release.

Title

browser.request still allows POST /reset-profile through the operator.write surface in OpenClaw v2026.3.22 after GHSA-vmhq-cqm9-6p7q

Severity Assessment

High

CWE:

• CWE-863: Incorrect Authorization

Proposed CVSS v3.1:

• 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)

An authenticated caller who only has access to the scoped Gateway method browser.request on the operator.write surface can still reach a destructive persistent-profile management route.

Likely related advisory family:

• GHSA-vmhq-cqm9-6p7q

This should be treated as a later-version residual or incomplete fix. The earlier fix blocked POST /profiles/create and profile deletion, but the latest released v2026.3.22 code still omits POST /reset-profile from the same mutation gate.

Impact

A caller with operator.write access to browser.request can still trigger persistent profile reset via POST /reset-profile.

This crosses the intended privilege boundary for browser profile management because the release already attempts to block adjacent persistent profile mutations on this same surface.

In practice, the allowed route reaches destructive behavior that can:

• stop the running browser for that profile
• close the Playwright browser connection for that profile
• move the profile's local userDataDir to Trash when it exists

This is a real integrity and availability impact on persistent browser state, not a route-classification mismatch with no side effects.

Affected Component

Product:

• openclaw

Tested latest released version:

• release tag: v2026.3.22
• release tag target commit (peeled tag): e7d11f6c33e223a0dd8a21cfe01076bd76cef87a

Published artifact for that release:

• package: openclaw-2026.3.22.tgz
• package build-info commit: 4dcc39c25c6cc63fedfd004f52d173716576fcf0
• package build-info timestamp: 2026-03-23T10:56:05.946Z

Exact vulnerable paths on the shipped tag:

• src/gateway/method-scopes.ts:114
  • browser.request is placed on the operator.write surface
• src/gateway/server-methods/browser.ts:155-165
  • requests are only denied when isPersistentBrowserProfileMutation(method, path) returns true
• src/browser/request-policy.ts:19-25
  • the mutation classifier recognizes POST /profiles/create and DELETE /profiles/:name, but not POST /reset-profile
• src/browser/routes/basic.ts:161-170
  • the browser server exposes POST /reset-profile
• src/browser/server-context.reset.ts:37-63
  • resetProfile() stops the browser, closes the connection, and moves the local profile directory to Trash when present
• src/node-host/invoke-browser.ts:240-243
  • the same route-classification helper is reused in the browser proxy path when profile restrictions are active

Relevant regression coverage gap on the shipped tag:

• src/gateway/server-methods/browser.profile-from-body.test.ts:104-140
  • tests only block POST /profiles/create and DELETE /profiles/:name
  • there is no equivalent deny case for POST /reset-profile

Published artifact evidence for the exact released package:

• openclaw-2026.3.22.tgz::package/dist/build-info.json
• openclaw-2026.3.22.tgz::package/dist/gateway-cli-Cxz4pSoJ.js:11469-11525
• openclaw-2026.3.22.tgz::package/dist/gateway-cli-Cxz4pSoJ.js:11484-11485
• openclaw-2026.3.22.tgz::package/dist/request-policy-nIRryZwZ.js:9-12
• openclaw-2026.3.22.tgz::package/dist/routes-CdaHRCET.js:6874-6889

Important release note:

• the published package build-info commit differs from the release tag target commit
• for this issue, the relevant authorization and route behavior was cross-checked in both the shipped tag source and the published package bundle, and it matches semantically on the vulnerable path

Technical Reproduction

A direct control/exploit pair can be reproduced against the latest released version.

Preconditions:

• use [email protected] -…