CVE-2026-32976: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32976 is an authorization bypass vulnerability in OpenClaw (npm package) that allows authenticated users with access to one account to modify protected configuration on sibling accounts, even when those accounts have configWrites: false. Affected versions are all releases up to and including 2026.3.8; the fix was introduced in version 2026.3.11. The vulnerability was published on March 31, 2026, with the original advisory authored by researcher tdjackey and assigned by VulnCheck. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). The mutation path for channel commands validated the originating account's configWrites policy but did not consistently re-authorize every resolved target scope — meaning an attacker could supply a user-controlled key (e.g., channels.<provider>.accounts.<id>) referencing a sibling account to redirect the write to a protected target. Specifically, channel commands such as /config set channels.<provider>.accounts.<id> and config-backed /allowlist ... --config --account could reach protected account configuration due to ambiguous collection and root writes under the channels namespace. The attack requires only low-level authenticated access over the network with no user interaction (GitHub Advisory).

Successful exploitation allows an authenticated attacker on one account within a shared OpenClaw gateway deployment to arbitrarily modify configuration settings on sibling accounts that are explicitly protected with configWrites: false. The integrity impact is high — an attacker could alter allowlists, channel settings, or other account-scoped configuration, potentially enabling unauthorized access, privilege escalation within the gateway, or malicious reconfiguration of other tenants. There is no confidentiality or availability impact reported; the vulnerability is scoped to a single gateway deployment and does not affect subsequent systems (GitHub Advisory, Github Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.026–0.042%, placing it in the 13th percentile for exploitation likelihood within 30 days. Exploitation requires low-privilege authenticated access to the OpenClaw gateway, limiting the attacker pool to existing account holders within a deployment.

1. Gain authenticated access: Obtain valid credentials or an authorized session on any account within the target OpenClaw gateway deployment (version ≤ 2026.3.8).
2. Identify target sibling account: Enumerate or infer the account ID of a sibling account that has configWrites: false set — this is the protected target.
3. Issue a crafted channel command: From the attacker-controlled account, execute a channel command referencing the target account's configuration path, e.g.:

   /config set channels.<provider>.accounts.<target-account-id>.<setting> <malicious-value>

4. Bypass authorization check: Because the authorization logic only validates the originating account's configWrites policy and not the resolved target scope, the command is accepted and applied to the protected sibling account.
5. Achieve unauthorized configuration change: The target account's protected configuration is now modified — for example, altering allowlists or channel settings — potentially enabling further unauthorized access or disruption within the gateway (GitHub Advisory).

• Logs: Audit or application logs showing channel commands (e.g., /config set channels.<provider>.accounts.<id>.*) issued from one account but targeting a different account's configuration path; repeated or unusual config mutation events on accounts with configWrites: false.
• Configuration State: Unexpected changes to account configuration values — particularly in channels.<provider>.accounts.* namespaces — on accounts that should be write-protected; modifications to allowlist entries via config-backed /allowlist commands on protected accounts.
• Behavioral: A single account issuing configuration commands that reference multiple different account IDs, especially those not belonging to the originating account's scope.

The primary remediation is to upgrade OpenClaw (npm) to version 2026.3.11 or later, which fixes the vulnerability by authorizing config mutations against both the origin scope and each resolved target scope, and by rejecting ambiguous root and collection writes from channel commands unless the caller is an internal gateway client with operator.admin privileges. No alternative workaround is available for unpatched versions — upgrade is the only recommended action. After upgrading, administrators should audit recent configuration changes on accounts with configWrites: false to detect any unauthorized modifications (GitHub Advisory).

The vulnerability was reported by researcher tdjackey and the advisory was published by steipete on the OpenClaw GitHub repository. The CVE was assigned by VulnCheck and received standard automated coverage from vulnerability aggregators including VulDB, CVEFeed, and Bluesky CVE bots shortly after disclosure. No significant vendor statements beyond the official advisory or notable independent researcher commentary have been identified.