CVE-2026-32914
Published: 29 March 2026
Summary
CVE-2026-32914 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Openclaw Openclaw. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 16.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-32914, published on 2026-03-29, is an insufficient access control vulnerability (CWE-863) in OpenClaw versions prior to 2026.3.12. The flaw affects the /config and /debug command handlers, which lack proper owner-level permission checks. This allows command-authorized non-owners to access owner-only surfaces, enabling unauthorized reading or modification of privileged configuration settings.
Attackers require low privileges in the form of command authorization (PR:L) to exploit the vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), yielding an overall CVSS v3.1 score of 8.8 (S:U).
Mitigation details are outlined in advisories from the OpenClaw GitHub security page at https://github.com/openclaw/openclaw/security/advisories/GHSA-r7vr-gr74-94p8 and VulnCheck at https://www.vulncheck.com/advisories/openclaw-insufficient-access-control-in-config-and-debug-endpoints.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16995
Vulnerability details
OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner-only surfaces. Attackers with command authorization can read or modify privileged configuration settings restricted to owners by exploiting…
more
missing owner-level permission checks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote insufficient access control flaw in command handlers allows low-priv users to reach owner-only config/debug surfaces (high C/I/A impact), directly enabling exploitation for privilege escalation (T1068) and abuse of a network-exposed application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for access to owner-only configuration surfaces in /config and /debug handlers, addressing the missing permission checks.
Implements a reference monitor to mediate all access attempts to privileged resources, preventing command-authorized non-owners from bypassing owner-level controls.
Applies least privilege to restrict command-authorized users from accessing owner-only surfaces, mitigating unauthorized read/modify of privileged settings.