CVE-2026-32976
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
OpenClaw before version 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can execute channel commands like /config set channels.<provider>.accounts.<id> to modify configuration on target accounts with configWrites: false.
Risk Assessment
Attackers can modify configuration of sibling accounts, potentially leading to unauthorized access to resources, data leakage, or service disruption.
Recommendation
Update OpenClaw to version 2026.3.11 or later and implement strict authorization controls for channel commands.
Original NVD description (English source)
OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can execute channel commands like /config set channels.<provider>.accounts.<id> to modify configuration on target accounts with configWrites: false.