CVE-2026-32972 in OpenClaw
Сводка (Английский)
OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only browser profile management routes through browser.request. Attackers can create or modify browser profiles and persist attacker-controlled remote CDP endpoints to disk without holding operator.admin privileges.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Ответственный
VulnCheck
Резервировать
17.03.2026
Раскрытие
29.03.2026
Статус
Подтверждённый
Записи
VulDB provides additional information and datapoints for this CVE:
| ИД | Уязвимость | CWE | Экс | Кон | CVE |
|---|---|---|---|---|---|
| 354109 | OpenClaw CDP эскалация привилегий | 863 | Не определено | Официальное исправление | CVE-2026-32972 |