CVE-2026-32914: OpenClaw access control bypass

CISO Take

OpenClaw before 2026.3.12 omits owner-level permission checks on its /config and /debug command handlers, allowing any low-privilege command-authorized user to read or overwrite configuration settings that should be restricted to owners. The vulnerability scores CVSS 8.8 — network-reachable, low privileges required, no user interaction, full C/I/A impact — and sits in the top 84th EPSS percentile for exploitation probability, making it statistically likely to attract active exploitation despite no public exploit yet being available. In AI agent deployments, configuration surfaces routinely store LLM API keys, system prompts, tool permissions, and provider credentials; an attacker who reads them gains lateral movement paths into connected AI services, while one who modifies them can silently redirect agent behavior across all subsequent interactions. Upgrade to OpenClaw 2026.3.12 immediately; if patching is blocked, audit and revoke non-essential command authorization grants and rotate any credentials stored in agent configuration.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS AIID

What is the risk?

High risk. CVSS 8.8 reflects a network-accessible exploit requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact on the affected scope. EPSS at the 84th percentile signals elevated exploitation probability relative to the broader CVE population, despite no public exploit or Nuclei template being available at time of disclosure. The 396 CVEs recorded in the same package indicate OpenClaw is an actively-researched target with sustained attacker interest. Blast radius is partially contained by only 4 downstream dependents, but AI agent configuration surfaces carry disproportionate value — exposure of embedded credentials or silent system prompt manipulation can cascade across the entire LLM-connected pipeline with minimal forensic trace.

How does the attack unfold?

Initial Access

Attacker leverages an existing low-privilege command authorization grant — such as a compromised team member account or an invited guest user — to authenticate to the OpenClaw instance.

AML.T0012

Exploitation

Attacker issues a request to the /config or /debug command handler; the missing owner-level permission check silently allows the request to succeed despite insufficient privileges.

AML.T0049

Collection

Owner-restricted configuration is returned in full, exposing LLM API keys, system prompt definitions, tool permission grants, and debug-level internal agent state.

AML.T0084

Persistence and Impact

Attacker writes modified configuration to redirect the LLM provider endpoint to an adversary-controlled proxy, enabling silent interception and manipulation of all subsequent agent interactions.

AML.T0081

Initial Access

Attacker leverages an existing low-privilege command authorization grant — such as a compromised team member account or an invited guest user — to authenticate to the OpenClaw instance.

AML.T0012

Exploitation

Attacker issues a request to the /config or /debug command handler; the missing owner-level permission check silently allows the request to succeed despite insufficient privileges.

AML.T0049

Collection

Owner-restricted configuration is returned in full, exposing LLM API keys, system prompt definitions, tool permission grants, and debug-level internal agent state.

AML.T0084

Persistence and Impact

Attacker writes modified configuration to redirect the LLM provider endpoint to an adversary-controlled proxy, enabling silent interception and manipulation of all subsequent agent interactions.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch immediately to OpenClaw 2026.3.12 or later, which adds owner-level authorization checks to /config and /debug handlers.
If patching is not possible, audit all principals holding command authorization and revoke any grants not strictly required.
Rotate all credentials (API keys, LLM provider tokens, tool secrets) stored in OpenClaw configuration if exploitation cannot be ruled out.
Monitor command handler logs for /config and /debug calls from non-owner principals — treat any unexpected hit as a potential IOC.
Isolate OpenClaw command interfaces behind network-layer controls (VPN, IP allowlist) to reduce the attack surface until the patch is applied.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Data Leakage Agent Framework AML.T0002.002 - AI Agent Configuration AML.T0049 - Exploit Public-Facing Application AML.T0081 - Modify AI Agent Configuration AML.T0083 - Credentials from AI Agent Configuration AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15(4) - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - Access Control for AI Systems

NIST AI RMF

GOVERN 1.7 - Processes for Identifying and Managing AI Risks

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32914?

OpenClaw before 2026.3.12 omits owner-level permission checks on its /config and /debug command handlers, allowing any low-privilege command-authorized user to read or overwrite configuration settings that should be restricted to owners. The vulnerability scores CVSS 8.8 — network-reachable, low privileges required, no user interaction, full C/I/A impact — and sits in the top 84th EPSS percentile for exploitation probability, making it statistically likely to attract active exploitation despite no public exploit yet being available. In AI agent deployments, configuration surfaces routinely store LLM API keys, system prompts, tool permissions, and provider credentials; an attacker who reads them gains lateral movement paths into connected AI services, while one who modifies them can silently redirect agent behavior across all subsequent interactions. Upgrade to OpenClaw 2026.3.12 immediately; if patching is blocked, audit and revoke non-essential command authorization grants and rotate any credentials stored in agent configuration.

Is CVE-2026-32914 actively exploited?

No confirmed active exploitation of CVE-2026-32914 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32914?

1. Patch immediately to OpenClaw 2026.3.12 or later, which adds owner-level authorization checks to /config and /debug handlers. 2. If patching is not possible, audit all principals holding command authorization and revoke any grants not strictly required. 3. Rotate all credentials (API keys, LLM provider tokens, tool secrets) stored in OpenClaw configuration if exploitation cannot be ruled out. 4. Monitor command handler logs for /config and /debug calls from non-owner principals — treat any unexpected hit as a potential IOC. 5. Isolate OpenClaw command interfaces behind network-layer controls (VPN, IP allowlist) to reduce the attack surface until the patch is applied.

What systems are affected by CVE-2026-32914?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-user AI agent deployments, LLM-connected agent pipelines, AI orchestration platforms.

What is the CVSS score for CVE-2026-32914?

CVE-2026-32914 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-user AI agent deploymentsLLM-connected agent pipelinesAI orchestration platforms

MITRE ATLAS Techniques

AML.T0002.002 AI Agent Configuration

AML.T0049 Exploit Public-Facing Application

AML.T0081 Modify AI Agent Configuration

AML.T0083 Credentials from AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15(4)

ISO 42001: A.6.2

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner-only surfaces. Attackers with command authorization can read or modify privileged configuration settings restricted to owners by exploiting missing owner-level permission checks.

Exploitation Scenario

An adversary with low-privilege command authorization — for example, a compromised team member account or an invited guest user — issues a crafted request to OpenClaw's /config command handler. Because the handler performs no owner-level check, the request succeeds and returns the full owner configuration including embedded LLM API keys and system prompt definitions. The adversary extracts these secrets for lateral movement to connected AI services, then issues a follow-up /config write to redirect the agent's LLM provider endpoint to an adversary-controlled proxy, enabling silent interception and manipulation of all future agent interactions. The /debug endpoint is subsequently queried to enumerate tool call history and internal agent state, providing intelligence for follow-on attacks against connected downstream systems without triggering alerts.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.