PT-2026-29232 · Openclaw · Openclaw

Tdjackey · CVE-2026-32976 · Published 2026-03-13 · Updated 2026-03-31

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description A flaw exists in OpenClaw that allows authorized users on one account to bypass authorization restrictions and modify configuration settings on other accounts, even when those accounts have configWrites set to false. This occurs through the execution of channel commands, such as /config set channels.<provider>.accounts.<id>, which are intended to modify configuration. The issue allows mutation of protected sibling-account configuration despite configWrites restrictions.

Recommendations Update to version 2026.3.11 or later.

Exploit

Fix

IDOR

Missing Authorization

Weakness Enumeration

CWE-639

CWE-862

Related Identifiers

CVE-2026-32976

GHSA-8JHH-JCQG-MJ5P

Affected Products

Openclaw

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32976.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-8jhh-jcqg-mj5p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32976 · Security Note
• https://osv.dev/vulnerability/GHSA-8jhh-jcqg-mj5p · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.11 · Note
• https://twitter.com/CVEnew/status/2039004485003923832 · Twitter Post
• https://vulncheck.com/advisories/openclaw-account-scoped-configwrites-policy-bypass-via-channel-commands · Note