OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
### Summary OpenClaw documented `/config` and `/debug` as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces. ### Impact This allowed a non-owner sender to read or change privileged configuration that should have remained restricted to owners. ### Affected versions `openclaw` `<= 2026.3.11` ### Patch Fixed in `openclaw` `2026.3.12`. Owner checks are now enforced for privileged command surfaces, and regression tests cover `/config` and `/debug` access control.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-32914US | —OT erhöht | — | ||
OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/08aa57a3de37d337b226ae861f573779f112ff2eWEB
- https://github.com/openclaw/openclaw/pull/44305WEB
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.12WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-r7vr-gr74-94p8WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan