CVE-2026-32976: OpenClaw auth bypass mutates

CISO Take

OpenClaw before 2026.3.11 allows any authenticated user to issue channel commands that overwrite sibling accounts' configuration even when those accounts have configWrites explicitly set to false — a horizontal privilege escalation that nullifies a primary access-control boundary in multi-tenant AI agent deployments. The CVSS is a moderate 6.5, but the EPSS places this vulnerability in the top 91st percentile for exploitation likelihood, with network-accessible exploitation requiring only low privileges and no user interaction. In AI agent platforms, channel configuration governs which providers, API credentials, and behavioral rules an agent follows, so this bypass gives an attacker cross-account control over AI agent behavior without touching authentication. Upgrade to OpenClaw 2026.3.11 immediately; if patching is not possible, isolate sensitive accounts into separate deployments and audit channel command logs for cross-account /config set invocations.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium CVSS (6.5) but operationally significant due to 91st-percentile EPSS exploitation likelihood and trivial attack complexity (AV:N/AC:L/PR:L/UI:N). The attack requires only a valid low-privilege account, making it accessible to compromised employees, malicious insiders, or anyone who has obtained basic credentials. In multi-tenant OpenClaw deployments, configWrites restrictions are the primary tenant isolation mechanism — this bypass renders that control entirely ineffective. The package carries 396 prior CVEs and only 4 downstream dependents, suggesting a concentrated but historically vulnerable codebase. Not in CISA KEV and no public exploit exists, but the EPSS signal warrants accelerated remediation.

How does the attack unfold?

Initial Access

Attacker obtains a valid low-privilege OpenClaw account via credential theft, phishing, or insider access on any account in the target deployment.

AML.T0012

Exploitation

Attacker issues a channel command targeting a sibling account (/config set channels.<provider>.accounts.<victim-id>) that bypasses the configWrites: false restriction due to the CWE-639 user-controlled key flaw.

AML.T0053

Configuration Mutation

Protected account configuration is overwritten — AI provider API credentials, channel routing, or behavioral guardrails are silently replaced with attacker-controlled values.

AML.T0081

Impact

Victim account's AI agent routes all LLM traffic through attacker infrastructure, enabling persistent interception of prompts and responses, credential harvesting, or sustained manipulation of AI agent behavior across the organization.

AML.T0048

Initial Access

Attacker obtains a valid low-privilege OpenClaw account via credential theft, phishing, or insider access on any account in the target deployment.

AML.T0012

Exploitation

Attacker issues a channel command targeting a sibling account (/config set channels.<provider>.accounts.<victim-id>) that bypasses the configWrites: false restriction due to the CWE-639 user-controlled key flaw.

AML.T0053

Configuration Mutation

Protected account configuration is overwritten — AI provider API credentials, channel routing, or behavioral guardrails are silently replaced with attacker-controlled values.

AML.T0081

Impact

Victim account's AI agent routes all LLM traffic through attacker infrastructure, enabling persistent interception of prompts and responses, credential harvesting, or sustained manipulation of AI agent behavior across the organization.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A None

What should I do?

5 steps

Upgrade to OpenClaw 2026.3.11 or later — the only complete remediation per the vendor advisory.
If immediate patching is blocked, deploy separate OpenClaw instances per account instead of relying on configWrites restrictions for isolation.
Audit channel command logs for invocations of the pattern /config set channels.<provider>.accounts.<id> that reference accounts other than the authenticated session's account.
Rotate all AI provider API keys and channel credentials for accounts that cannot rule out unauthorized cross-account access since the vulnerability was introduced.
Implement network-level ACLs to restrict which source accounts can issue channel commands to the configuration API as a defense-in-depth measure.

How is it classified?

Auth Bypass Agent AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI System Design and Controls

NIST AI RMF

MANAGE 2.4 - Mechanisms to Prevent Unauthorized Access

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32976?

OpenClaw before 2026.3.11 allows any authenticated user to issue channel commands that overwrite sibling accounts' configuration even when those accounts have configWrites explicitly set to false — a horizontal privilege escalation that nullifies a primary access-control boundary in multi-tenant AI agent deployments. The CVSS is a moderate 6.5, but the EPSS places this vulnerability in the top 91st percentile for exploitation likelihood, with network-accessible exploitation requiring only low privileges and no user interaction. In AI agent platforms, channel configuration governs which providers, API credentials, and behavioral rules an agent follows, so this bypass gives an attacker cross-account control over AI agent behavior without touching authentication. Upgrade to OpenClaw 2026.3.11 immediately; if patching is not possible, isolate sensitive accounts into separate deployments and audit channel command logs for cross-account /config set invocations.

Is CVE-2026-32976 actively exploited?

No confirmed active exploitation of CVE-2026-32976 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32976?

1. Upgrade to OpenClaw 2026.3.11 or later — the only complete remediation per the vendor advisory. 2. If immediate patching is blocked, deploy separate OpenClaw instances per account instead of relying on configWrites restrictions for isolation. 3. Audit channel command logs for invocations of the pattern /config set channels.<provider>.accounts.<id> that reference accounts other than the authenticated session's account. 4. Rotate all AI provider API keys and channel credentials for accounts that cannot rule out unauthorized cross-account access since the vulnerability was introduced. 5. Implement network-level ACLs to restrict which source accounts can issue channel commands to the configuration API as a defense-in-depth measure.

What systems are affected by CVE-2026-32976?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, multi-tenant agent platforms, AI provider integrations.

What is the CVSS score for CVE-2026-32976?

CVE-2026-32976 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksmulti-tenant agent platformsAI provider integrations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrites restrictions. Attackers with authorized access on one account can execute channel commands like /config set channels.<provider>.accounts.<id> to modify configuration on target accounts with configWrites: false.

Exploitation Scenario

An attacker who compromises or controls a low-privilege OpenClaw account — via credential stuffing, phishing, or malicious insider — issues the channel command /config set channels.openai.accounts.<victim-account-id>.api_key=<attacker-controlled-key>. Because the authorization check fails to validate that the channel command is scoped to the authenticated account (CWE-639: authorization bypass through user-controlled key), the command succeeds despite the target account having configWrites: false. The victim account's AI agent now routes all LLM queries through attacker-controlled infrastructure, enabling interception of sensitive prompts, responses, and data in context — effectively man-in-the-middle of the victim's AI agent pipeline without triggering authentication alerts.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.