PT-2026-29232 · Openclaw · Openclaw

Tdjackey · Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-32976

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description A flaw exists in OpenClaw that allows authorized users on one account to bypass authorization restrictions and modify configuration settings on other accounts, even when those accounts have configWrites set to false. This occurs through the execution of channel commands, such as /config set channels.<provider>.accounts.<id>, which are intended to modify configuration. The issue allows mutation of protected sibling-account configuration despite configWrites restrictions.

Recommendations Update to version 2026.3.11 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-32976

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8jhh-jcqg-mj5p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32976 · Security Note
• https://vulncheck.com/advisories/openclaw-account-scoped-configwrites-policy-bypass-via-channel-commands · Note
• https://twitter.com/CVEnew/status/2039004485003923832 · Twitter Post