漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
OpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection
Vulnerability Description
OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profiles at runtime to access restricted profiles and bypass intended access controls.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Vulnerability Type
对假设不可变Web参数的外部可控制
Vulnerability Title
OpenClaw 安全漏洞
Vulnerability Description
OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw 2026.3.22之前版本存在安全漏洞，该漏洞源于allowProfiles功能中存在访问控制绕过漏洞，允许攻击者通过持久化配置文件变异和运行时配置文件选择来规避配置文件限制，远程攻击者可通过在运行时操纵浏览器代理配置文件来访问受限配置文件并绕过预期的访问控制。
CVSS Information
N/A
Vulnerability Type
N/A