Executive brief
OpenClaw is a tool used for managing permissions and tool execution. A vulnerability in its permission resolution system allows an attacker to bypass security prompts that normally warn users before a 'dangerous' tool is executed. This could lead to unauthorized actions being performed on a system without the user's explicit consent or knowledge.
Technical details
A vulnerability exists in OpenClaw's Agent Control Protocol (ACP) permission resolution logic within `src/acp/client.ts`. The system incorrectly trusted spoofable `rawInput` and metadata hints when determining tool identity, leading to a situation where conflicting identity hints could be used to suppress mandatory security prompts for 'dangerous' tools. An attacker with low privileges can exploit this by providing crafted input that misrepresents a tool's identity to the permission resolver. This results in an authorization bypass (CWE-863) where sensitive tools are executed without the required user interaction. The issue is fixed in version 2026.3.22 by ensuring the client fails closed when tool identity hints from different sources conflict.
Affected products
- OpenClaw openclaw < 2026.3.22
Timeline
- 2026-03-24: disclosed: Advisory published on GitHub
- 2026-03-22: patched: Fix released in version 2026.3.22
- 2026-04-10: advisory: NVD published CVE-2026-35655