CVE-2026-32976 in OpenClaw
Sumário (Inglês)
OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can execute channel commands like /config set channels..accounts. to modify configuration on target accounts with configWrites: false.
Responsável
VulnCheck
Reservar
17/03/2026
Divulgação
31/03/2026
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 354370 | OpenClaw Configuration config Elevação de Privilégios | 639 | Não definido | Correção oficial | CVE-2026-32976 |