PT-2026-29232 · Openclaw · Openclaw

Tdjackey · Publicado 2026-03-31 · Atualizado 2026-03-31 · CVE-2026-32976

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description A flaw exists in OpenClaw that allows authorized users on one account to bypass authorization restrictions and modify configuration settings on other accounts, even when those accounts have configWrites set to false. This occurs through the execution of channel commands, such as /config set channels.<provider>.accounts.<id>, which are intended to modify configuration. The issue allows mutation of protected sibling-account configuration despite configWrites restrictions.

Recommendations Update to version 2026.3.11 or later.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-32976

Produtos afetados

Openclaw

Referências · 4

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8jhh-jcqg-mj5p · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-account-scoped-configwrites-policy-bypass-via-channel-commands · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32976 · Nota de Segurança
• https://twitter.com/CVEnew/status/2039004485003923832 · Publicação no Twitter