CVE-2026-32976
CVE-2026-32976 · OpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can execute channel commands like /config set channels.<provider>.accounts.<id> to modify configuration on target accounts with configWrites: false.
CVSS 7.1 · Alta · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node