CVE-2026-32898 Details
Description
OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool metadata or using non-core read-like names to reach auto-approve paths.
A vulnerability allowing authorization bypass in the OpenClaw ACP client has been identified in versions prior to 2026.2.23. This vulnerability allows tool calls to be auto-approved based on untrusted metadata and lenient name heuristics. Attackers can exploit this by spoofing tool metadata or using non-core read-like names to bypass interactive approval prompts for read-class operations.
Users can update to OpenClaw version 2026.2.23 or later, where this vulnerability has been patched. The update includes changes to the permission auto-approval policy, requiring trusted core tool IDs and scoping read approvals to the active working directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-807 | Reliance on Untrusted Inputs in a Security Decision | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openclaw openclaw | < 2026.2.23 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 21, 2026 | New CVE Received | [email protected] |