https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T23:41:55.915579+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/brew-openclaw-cli-cve-2026-32914 BREW-openclaw-cli-CVE-2026-32914 — OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces 2026-10-08T23:41:58.458233+00:00

Affected: Homebrew: openclaw-cli

### Summary

OpenClaw documented `/config` and `/debug` as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces.

### Impact

This allowed a non-owner sender to read or change privileged configuration that should have remained restricted to owners.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Owner checks are now enforced for privileged command surfaces, and regression tests cover `/config` and `/debug` access control.