{"id":"CVE-2026-32914","aliases":["GHSA-r7vr-gr74-94p8"],"url":"https://o3.security/vulnerability/CVE-2026-32914","summary":"OpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug Endpoints","details":"### Summary\n\nOpenClaw documented `/config` and `/debug` as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces.\n\n### Impact\n\nThis allowed a non-owner sender to read or change privileged configuration that should have remained restricted to owners.\n\n### Affected versions\n\n`openclaw` `<= 2026.3.11`\n\n### Patch\n\nFixed in `openclaw` `2026.3.12`. Owner checks are now enforced for privileged command surfaces, and regression tests cover `/config` and `/debug` access control.","published":"2026-03-29T12:44:19.939Z","modified":"2026-10-21T02:56:46.533810773Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.3.12"}],"fix":{"url":"https://github.com/openclaw/openclaw/pull/44305","label":"openclaw/openclaw#44305"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32914.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r7vr-gr74-94p8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32914"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openclaw-insufficient-access-control-in-config-and-debug-endpoints"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/pull/44305"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/08aa57a3de37d337b226ae861f573779f112ff2e"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/releases/tag/v2026.3.12"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:56:46.533810773Z"}}