Openclaw cli: OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes (CVE-2026-32972)

CVE-2026-32972 describes an authorization flaw in OpenClaw CLI where the browser.request endpoint could be accessed by users with operator.write privileges to reach browser profile management routes that persist configuration changes to disk. This exposed an admin-only configuration write primitive through the /profiles/create route, allowing unauthorized creation or modification of browser profiles and injection of remote CDP endpoints. The vulnerability affects OpenClaw versions >=2026.1.29 and <2026.3.11 and was resolved in version 2026.3.11 by enforcing the correct admin boundary for browser profile creation and adding regression tests to verify the authorization split.

An attacker with operator.write privileges, which normally do not include admin rights, could create or modify browser profiles and persist arbitrary remote CDP endpoints. This elevates the attacker's ability to alter critical configuration data without proper authorization, potentially impacting integrity and availability of the system. There is no indication of confidentiality impact. The CVSS score is 7.1 (high severity) reflecting network attack vector, low complexity, and no user interaction required.

A patch is available and should be applied. The vulnerability is fixed in OpenClaw CLI version 2026.3.11 and later. Upgrading to version 2026.3.11 or newer will enforce the correct admin authorization boundary for browser profile creation, preventing unauthorized persistence of admin-only configuration changes.