OpenClaw Authorization Bypass Vulnerability Allowing Unauthorized Configuration Changes on Sibling Accounts

An authorization bypass vulnerability has been identified in OpenClaw versions prior to 2026.3.11. This vulnerability allows channel commands to modify protected configuration on sibling accounts, despite existing restrictions. Attackers with authorized access to one account can use channel commands to alter settings on target accounts that have 'configWrites' disabled.

Impact

Exploitation of this vulnerability allows for unauthorized modifications to account-specific configurations on sibling accounts, potentially leading to misconfigurations or unauthorized access to features or settings.

Remediation

Users are advised to upgrade to OpenClaw version 2026.3.11 or later.