Loading...
Skip to main content
GeekWala

CVE-2026-32914

HIGH

OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces

Published March 13, 2026Updated July 8, 2026Source: osv

Summary

### Summary OpenClaw documented `/config` and `/debug` as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces. ### Impact This allowed a non-owner sender to read or change privileged configuration that should have remained restricted to owners. ### Affected versions `openclaw` `<= 2026.3.11` ### Patch Fixed in `openclaw` `2026.3.12`. Owner checks are now enforced for privileged command surfaces, and regression tests cover `/config` and `/debug` access control.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update openclaw to 2026.3.12 or later
npm install openclaw@2026.3.12

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

PackageEcosystemAffectedFixed In
openclaw
npm
All versions2026.3.12

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-285
    Improper AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-32914?
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-32914?
CVE-2026-32914 affects openclaw. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-32914 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-r7vr-gr74-94p8

Related CVEs

  • CVE-2026-34507
    CRITICAL

    OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

  • CVE-2026-41397
    HIGH

    OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal

  • CVE-2026-45006
    HIGH

    OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

  • CVE-2026-35643
    HIGH

    OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface

  • CVE-2026-53807
    HIGH

    OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

  • CVE-2026-32023
    MEDIUM

    OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode

  • CVE-2026-42422
    MEDIUM

    OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

  • CVE-2026-32038
    MEDIUM

    OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies