Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-32976

OpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can execute channel commands like /config set channels.<provider>.accounts.<id> to modify configuration on target accounts with configWrites: false.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenClaw OpenClaw

Default version status: unaffected

  • 0 to < 2026.3.11affected
  • 2026.3.11unaffected
pkg:npm/openclaw

References