OpenClaw Security Bypass Vulnerability Allowing Persistent Profile Mutation

A security bypass vulnerability has been identified in OpenClaw versions prior to 2026.4.8. The issue arises in the `node.invoke(browser.proxy)` function, which can be exploited to mutate persistent browser profiles. This vulnerability allows attackers to circumvent the `browser.request` guard that protects against unauthorized profile modifications, enabling them to alter browser configurations instead.

Impact

Exploitation of this vulnerability allows for unauthorized modifications of persistent browser profiles, bypassing existing safeguards and potentially leading to malicious configuration changes.

Reproduction

The vulnerability can be reproduced by invoking the `node.invoke(browser.proxy)` function in an OpenClaw environment. This action will bypass the `browser.request` guard and allow for unauthorized changes to be made to the persistent browser profile.

Remediation

Users can update to OpenClaw version 2026.4.8 or later to address this vulnerability.