CVE-2026-32898: Openclaw Authorization Bypass Vulnerability

CVE-2026-32898 Overview

OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP (Agent Control Protocol) client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool metadata or using non-core read-like names to reach auto-approve paths.

Critical Impact

This authorization bypass vulnerability allows attackers to execute tool operations without user approval by manipulating tool metadata, potentially leading to unauthorized data access and system compromise.

Affected Products

• OpenClaw versions prior to 2026.2.23
• OpenClaw ACP client for Node.js
• OpenClaw tool catalog components

Discovery Timeline

• 2026-03-21 - CVE-2026-32898 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-32898

Vulnerability Analysis

This vulnerability is classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The OpenClaw ACP client implements an auto-approval mechanism for certain tool calls to streamline user workflows. However, the implementation relies on untrusted metadata provided in the toolCall.kind field and uses overly permissive name-matching heuristics to determine whether a tool call should bypass interactive approval prompts.

The core issue stems from the client trusting tool metadata that can be controlled or spoofed by an attacker. When processing tool calls, the ACP client checks whether a tool appears to be a "safe" read-class operation based on its declared kind and name. If the tool matches certain patterns (such as containing "read" or "search" in the name), it may be auto-approved without user interaction.

Root Cause

The root cause is twofold: first, the ACP client does not validate that tool identifiers correspond to known, trusted core tools before applying auto-approval logic. Second, the name-matching heuristics are too permissive, allowing attackers to craft tool names that trigger auto-approval paths while actually performing different operations.

The vulnerable implementation lacked proper validation to ensure that only genuine core tools with verified identifiers could benefit from auto-approval, and it failed to enforce strict naming conventions that would prevent spoofing attempts.

Attack Vector

The attack is network-accessible and requires low privileges to execute. An attacker can exploit this vulnerability by:

1. Crafting a malicious tool call with a spoofed toolCall.kind metadata field that mimics a safe read-class operation
2. Using tool names that match the permissive heuristics (containing patterns like "read", "search", etc.)
3. Submitting the crafted tool call to bypass interactive approval prompts
4. Executing unauthorized operations that would normally require explicit user consent

The security patches introduce proper validation to address these attack vectors:

   }
   return [...tool.profiles];
 }
+
+export function isKnownCoreToolId(toolId: string): boolean {
+  return CORE_TOOL_BY_ID.has(toolId);
+}

Source: GitHub Commit Update

The fix introduces a function to verify that tool identifiers are registered core tools before auto-approval logic is applied.

Additional hardening includes strict tool name validation:

 const SAFE_AUTO_APPROVE_TOOL_IDS = new Set(["read", "search", "web_search", "memory_search"]);
 const TRUSTED_SAFE_TOOL_ALIASES = new Set(["search"]);
 const READ_TOOL_PATH_KEYS = ["path", "file_path", "filePath"];
+const TOOL_NAME_MAX_LENGTH = 128;
+const TOOL_NAME_PATTERN = /^[a-z0-9._-]+$/;
 const TOOL_KIND_BY_ID = new Map<string, string>([
   ["read", "read"],
   ["search", "search"],

Source: GitHub Commit Fix

This patch enforces a maximum length constraint and a strict character pattern for tool names, preventing injection of malicious or obfuscated tool identifiers.

Detection Methods for CVE-2026-32898

Indicators of Compromise

• Unusual tool call patterns with non-standard or unexpected tool identifiers
• Tool calls with metadata fields that don't match registered core tool definitions
• Elevated frequency of auto-approved operations from untrusted sources
• Log entries showing tool calls that bypass normal approval workflows

Detection Strategies

• Monitor ACP client logs for tool calls with suspicious or malformed toolCall.kind metadata
• Implement anomaly detection for tool names that match read-class patterns but originate from untrusted contexts
• Review tool call audit logs for operations that should have required user approval but were auto-approved
• Deploy application-layer monitoring to detect tool calls exceeding the 128-character name limit

Monitoring Recommendations

• Enable verbose logging for the ACP client to capture all tool call metadata
• Set up alerts for tool calls from tools not in the CORE_TOOL_BY_ID registry
• Monitor for rapid successive tool calls that may indicate automated exploitation attempts
• Review access patterns for read-class operations to identify anomalous behavior

How to Mitigate CVE-2026-32898

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.23 or later immediately
• Review recent tool call logs for signs of exploitation
• Audit any custom tool integrations for proper identifier registration
• Temporarily disable auto-approval functionality if immediate patching is not possible

Patch Information

Security patches are available through the official OpenClaw GitHub repository. Two commits address this vulnerability:

• Commit 12cc754 - Introduces isKnownCoreToolId() function for proper tool validation
• Commit 63dcd28 - Adds tool name length limits and character pattern validation

For complete details, see the GitHub Security Advisory GHSA-7jx5-9fjg-hp4m and the VulnCheck Advisory on OpenClaw.

Workarounds

• Disable the auto-approval feature in ACP client configuration until patching is complete
• Implement a whitelist of allowed tool identifiers at the application layer
• Add network-level monitoring to detect and block suspicious tool call patterns
• Configure the ACP client to require explicit user approval for all tool operations

# Configuration example - disable auto-approval in OpenClaw ACP client
export OPENCLAW_ACP_AUTO_APPROVE=false
export OPENCLAW_REQUIRE_EXPLICIT_APPROVAL=true
# Alternatively, configure in openclaw.config.js
# acp: { autoApprove: false, strictToolValidation: true }