Which versions of Openclaw are affected by CVE-2026-32914?

OpenClaw versions before 2026.3.12 contain a privilege escalation vulnerability allowing authenticated command-authorized users to bypass role-based access controls and access owner-only…. A patch is available.

How to fix or mitigate CVE-2026-32914?

Within 24 hours: Inventory all OpenClaw deployments and current versions in your environment. Within 7 days: Upgrade OpenClaw to version 2026.3.12 or later on all affected systems; prioritize production and administrative-tier instances. Within 30 days: Audit logs for unauthorized access to configuration and debug endpoints by non-owner accounts; review and reset any credentials or settings modified during the vulnerability exposure window.

Openclaw CVE-2026-32914

Q: What is the CVSS score of CVE-2026-32914?

CVE-2026-32914 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16995 HIGH

Incorrect Authorization (CWE-863)

2026-03-29 VulnCheck

Authentication Bypass Openclaw

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:11 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.12

EUVD ID Assigned

Mar 29, 2026 - 13:15 euvd

EUVD-2026-16995

Analysis Generated

Mar 29, 2026 - 13:15 vuln.today

CVE Published

Mar 29, 2026 - 12:44 nvd

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.12.

DescriptionCVE.org

OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner-only surfaces. Attackers with command authorization can read or modify privileged configuration settings restricted to owners by exploiting missing owner-level permission checks.

AnalysisAI

Privilege escalation in OpenClaw versions before 2026.3.12 allows authenticated users with command authorization to access owner-restricted configuration and debug endpoints due to missing permission checks. Attackers can read and modify privileged settings intended only for owners, effectively bypassing role-based access controls. CVSS 8.7 (High) with EPSS data unavailable; no public exploit identified at time of analysis, though the vulnerability class (CWE-863: incorrect authorization) is commonly targeted once disclosed.

Technical ContextAI

OpenClaw implements a role-based access control system with distinct permission levels: command-authorized users and owners. The vulnerability exists in the /config and /debug command handlers, which fail to implement owner-level permission checks before granting access to privileged operations. This is a classic CWE-863 (Incorrect Authorization) flaw where authentication is verified (users must have command authorization) but subsequent authorization checks fail to validate whether the authenticated principal possesses owner-level privileges. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) across all versions prior to 2026.3.12. The /config endpoint likely exposes application configuration parameters, while /debug surfaces typically provide diagnostic information or debugging capabilities that could reveal sensitive system details or allow runtime modification of application behavior.

RemediationAI

Upgrade OpenClaw to version 2026.3.12 or later, which contains vendor-released patches implementing proper owner-level permission checks in the /config and /debug command handlers. The fix version is explicitly documented in the GitHub Security Advisory (https://github.com/openclaw/openclaw/security/advisories/GHSA-r7vr-gr74-94p8). Organizations unable to immediately upgrade should implement compensating controls: restrict network access to the affected endpoints using firewall rules or reverse proxy ACLs, audit all accounts with command authorization to ensure minimum necessary privileges, enable comprehensive logging for /config and /debug endpoint access to detect exploitation attempts, and review recent access logs for unauthorized configuration changes by non-owner accounts. No workaround can fully mitigate the vulnerability without code-level fixes, making timely patching the definitive remediation strategy.