diff --git a/server/src/main/java/com/rocketmq/studio/cluster/broker/ClusterController.java b/server/src/main/java/com/rocketmq/studio/cluster/broker/ClusterController.java
index 5669d734..d0787420 100644
--- a/server/src/main/java/com/rocketmq/studio/cluster/broker/ClusterController.java
+++ b/server/src/main/java/com/rocketmq/studio/cluster/broker/ClusterController.java
@@ -19,6 +19,7 @@
 import com.rocketmq.studio.cluster.config.UpdateConfigDTO;
 
 import com.rocketmq.studio.common.domain.Result;
+import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -48,7 +49,7 @@ public Result<ClusterVO> getCluster(@PathVariable String id) {
     }
 
     @PostMapping("/config/update")
-    public Result<ClusterVO> updateClusterConfig(@RequestBody UpdateConfigDTO command) {
+    public Result<ClusterVO> updateClusterConfig(@Valid @RequestBody UpdateConfigDTO command) {
         return Result.ok(clusterService.updateClusterConfig(command));
     }
 
diff --git a/server/src/main/java/com/rocketmq/studio/cluster/config/UpdateConfigDTO.java b/server/src/main/java/com/rocketmq/studio/cluster/config/UpdateConfigDTO.java
index 4544c932..ba7dfe78 100644
--- a/server/src/main/java/com/rocketmq/studio/cluster/config/UpdateConfigDTO.java
+++ b/server/src/main/java/com/rocketmq/studio/cluster/config/UpdateConfigDTO.java
@@ -16,6 +16,7 @@
  */
 package com.rocketmq.studio.cluster.config;
 
+import jakarta.validation.constraints.NotBlank;
 import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;
@@ -26,7 +27,9 @@
 @NoArgsConstructor
 @AllArgsConstructor
 public class UpdateConfigDTO {
+    @NotBlank(message = "id is required")
     private String id;
+
     private String flushDiskType;
     private Boolean autoCreateTopicEnable;
     private Boolean autoCreateSubscriptionGroup;
diff --git a/server/src/test/java/com/rocketmq/studio/cluster/broker/ClusterControllerTest.java b/server/src/test/java/com/rocketmq/studio/cluster/broker/ClusterControllerTest.java
index 395e8117..ed3e8ca9 100644
--- a/server/src/test/java/com/rocketmq/studio/cluster/broker/ClusterControllerTest.java
+++ b/server/src/test/java/com/rocketmq/studio/cluster/broker/ClusterControllerTest.java
@@ -35,6 +35,7 @@
 import java.util.Collections;
 
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
@@ -135,6 +136,40 @@ void updateConfigShouldReturnUpdatedCluster() throws Exception {
                 .andExpect(jsonPath("$.data.config.readQueueNums").value(16));
     }
 
+    @Test
+    void updateConfigShouldRejectMissingId() throws Exception {
+        UpdateConfigDTO command = UpdateConfigDTO.builder()
+                .flushDiskType("SYNC_FLUSH")
+                .writeQueueNums(16)
+                .build();
+
+        mockMvc.perform(post("/api/clusters/config/update")
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content(objectMapper.writeValueAsString(command)))
+                .andExpect(status().isBadRequest())
+                .andExpect(jsonPath("$.code").value(400))
+                .andExpect(jsonPath("$.message").value("id is required"));
+
+        verifyNoInteractions(clusterService);
+    }
+
+    @Test
+    void updateConfigShouldRejectBlankId() throws Exception {
+        UpdateConfigDTO command = UpdateConfigDTO.builder()
+                .id(" ")
+                .flushDiskType("SYNC_FLUSH")
+                .build();
+
+        mockMvc.perform(post("/api/clusters/config/update")
+                        .contentType(MediaType.APPLICATION_JSON)
+                        .content(objectMapper.writeValueAsString(command)))
+                .andExpect(status().isBadRequest())
+                .andExpect(jsonPath("$.code").value(400))
+                .andExpect(jsonPath("$.message").value("id is required"));
+
+        verifyNoInteractions(clusterService);
+    }
+
     @Test
     void restartBrokerShouldReturnSuccess() throws Exception {
         when(clusterService.restartBroker("cluster-1", "broker-0")).thenReturn(true);