OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
### Summary OpenClaw documented `/config` and `/debug` as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces. ### Impact This allowed a non-owner sender to read or change privileged configuration that should have remained restricted to owners. ### Affected versions `openclaw` `<= 2026.3.11` ### Patch Fixed in `openclaw` `2026.3.12`. Owner checks are now enforced for privileged command surfaces, and regression tests cover `/config` and `/debug` access control.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32914US | —OT elevated | — | ||
OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/08aa57a3de37d337b226ae861f573779f112ff2eWEB
- https://github.com/openclaw/openclaw/pull/44305WEB
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.12WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-r7vr-gr74-94p8WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan