Openclaw CVE-2026-32898

The CVSS 3.1 score of 5.4 (Medium) reflects moderate real-world risk with favorable attack conditions: the vulnerability requires low attack complexity (AC:L), network accessibility (AV:N), but mandates user privileges (PR:L), limiting opportunistic exploitation. The impact is balanced—confidentiality and integrity are degraded (C:L, I:L) but availability is unaffected (A:N), ruling out denial-of-service scenarios. EPSS data is not provided in source intelligence, but the combination of low attack complexity and permission-bypass characteristics suggests above-baseline exploitation probability in environments where OpenClaw deployments host sensitive tool integrations. Without KEV designation or public POC weaponization reports, this is unlikely to be actively exploited at scale, but the authorization bypass nature makes it a credible priority for any organization using OpenClaw in agent-based workflows. From an SSVC perspective, exploitation is mostly straightforward for an authenticated attacker with access to the ACP interface, and technical impact (unauthorized data access/modification) is notable in multi-tenant or sensitive-operation contexts.

A low-privileged authenticated user with access to OpenClaw's ACP client crafts a malicious tool invocation with a spoofed toolCall.kind metadata field (e.g., setting kind to a value matching permissive read-heuristics) or uses a function name like read_sensitive_data that matches non-core naming patterns. Due to insufficient metadata validation, the ACP client automatically approves the operation and executes it without presenting an interactive approval prompt, allowing the attacker to read confidential data or modify system state without authorization. Since network access is required (AV:N) and the attacker must already possess valid credentials (PR:L), this is a privilege escalation scenario within OpenClaw environments rather than a remote unauthenticated exploit.