CVE-2026-32898: Openclaw

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool metadata or using non-core read-like names to reach auto-approve paths.

Affected products

• Openclaw Openclaw: before 2026.2.23 (fixed in 2026.2.23)

Published 2026-03-21. Last modified 2026-06-17.