CVE-2026-32914CWE-863

OpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug Endpoints

High · published March 29, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
38.0
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner-only surfaces. Attackers with command authorization can read or modify privileged configuration settings restricted to owners by exploiting missing owner-level permission checks.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00447 · 38.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-29T12:44Z
EPSS history
Timeline
  • 29 MAR 12:44Z
    OpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug Endpoints
    cvelistv5