VULNERABILITY INTELLIGENCE

CVE-2026-32976

CVSS score6.5 MEDIUM
EPSS probability0.20%
CISA KEVNot currently listed
Published2026-03-31
Last modified2026-07-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can execute channel commands like /config set channels.<provider>.accounts.<id> to modify configuration on target accounts with configWrites: false.

Weakness classification

  • disclosure@vulncheck.com: CWE-639

Primary references