A critical authorization vulnerability in OpenClaw allows authenticated non-owner users to gain unauthorized access to and modify sensitive system configurations.

This flaw is categorized as CWE-863, Incorrect Authorization, occurring within the /config and /debug command handlers. An attacker who already possesses command authorization can bypass owner-level checks to read or modify privileged settings due to missing permission validation.

The ability for non-privileged users to manipulate core configuration settings presents a significant risk to system integrity and operational security. Given the CVSS score of 8.8, this vulnerability is classified as High, as it could lead to unauthorized system control, potential privilege escalation, or the disabling of critical security features.

Immediate Action: Update the OpenClaw package to version 2026.3.12 or later to apply the necessary access control patches.

Proactive Monitoring: Review application audit logs for unusual access patterns or modifications occurring within the /config and /debug endpoints by non-administrative user accounts.

Compensating Controls: If immediate patching is not possible, restrict network access to the management and debug interfaces to trusted IP ranges using a Web Application Firewall or network-level access control list.

Public Exploit Available: No

Organizations utilizing OpenClaw must prioritize updating to version 2026.3.12 immediately to remediate this authorization bypass. Failure to patch leaves the system susceptible to configuration manipulation by any authenticated user, which could result in a total compromise of the application environment.