Executive brief
OpenClaw is a client tool for managing AI tool invocations and permissions in automated environments. A flaw in its permission system allows malicious or compromised tools to bypass interactive approval prompts by spoofing trusted metadata, potentially enabling unauthorized read access to sensitive data or operations without explicit user consent.
Technical details
This is an authorization bypass vulnerability in the OpenClaw ACP client's permission approval system (CWE-285, CWE-639). The vulnerability stems from insecure permission classification that trusts untrusted metadata in incoming toolCall.kind fields and uses permissive heuristic name matching. A malicious or compromised ACP tool can spoof its metadata to appear as a trusted core tool, allowing it to reach auto-approval code paths that bypass interactive approval prompts for read-class operations. The read operation scope was not properly validated against current working directory (cwd) across all metadata and title forms. The fix (v2026.2.23) requires trusted core tool IDs for auto-approval, ignores untrusted toolCall.kind as an authorization source, strengthens read auto-approval scoping to cwd-resolved paths, and adds stricter tool-name validation.
Affected products
- OpenClaw openclaw <= 2026.2.22-2
Timeline
- 2026-02-27: disclosed
- 2026-02-24: patched: v2026.2.23 released