Read the docs
TI-2026-66375 Aliases GHSA-r7vr-gr74-94p8

OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces

Priority LOW 38CWE-285Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Security bypass
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-285.

Summary

### Summary OpenClaw documented `/config` and `/debug` as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces. ### Impact This allowed a non-owner sender to read or change privileged configuration that should have remained restricted to owners. ### Affected versions `openclaw` `<= 2026.3.11` ### Patch Fixed in `openclaw` `2026.3.12`. Owner checks are now enforced for privileged command surfaces, and regression tests cover `/config` and `/debug` access control.

Why it matters now

Fix Fixed openclaw (npm): 2026.3.12

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—openclaw (npm)before 2026.3.122026.3.12Patch availableGHSA-r7vr-gr74-94p8
  • openclaw (npm) Vendor— Affected before 2026.3.12 Fixed in 2026.3.12 Patch available GHSA-r7vr-gr74-94p8

Remediation

  • Fix · GHSA-r7vr-gr74-94p8 openclaw (npm) Fixed in 2026.3.12 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-r7vr-gr74-94p8

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences