Executive brief
OpenClaw is an open-source communication and collaboration gateway that handles real-time chat messaging. A vulnerability in its chat message handling allows authenticated operators to spoof ACP (Administrator Control Plane) identity labels and inject provenance fields that should be restricted to ACP bridge clients only, potentially enabling unauthorized operators to impersonate system components.
Technical details
The vulnerability is an authentication bypass (CWE-290) and reliance on untrusted inputs in security decisions (CWE-807) in the chat.send method. ACP-only provenance fields were gated using self-declared client metadata from WebSocket handshake messages rather than verified authorization state. An authenticated operator client could exploit this by crafting malicious WebSocket messages to spoof ACP identity labels and inject reserved provenance fields. The vulnerability affects all versions through 2026.3.24 and was fixed in version 2026.3.28 by commit 4b9542716c, which added verification of the caller's scope before accepting provenance fields.
Affected products
- OpenClaw OpenClaw <= 2026.3.24
Timeline
- 2026-03-31: disclosed: Advisory published
- 2026-03-28: patched: Fix released in version 2026.3.28
- 2026-03-27: other: Fix committed (4b9542716c)