What is the CVSS score of CVE-2026-32898?

CVE-2026-32898 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-32898?

CVE-2026-32898 presents moderate security risk rated CVSS 5.4. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2026-32898?

Yes, a public proof-of-concept exploit is available for CVE-2026-32898. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-32898?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Openclaw CVE-2026-32898

EUVD-2026-13976 MEDIUM

Reliance on Untrusted Inputs in a Security Decision (CWE-807)

2026-03-21 VulnCheck

Authentication Bypass Openclaw

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Mar 24, 2026 - 21:07 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 01:00 euvd

EUVD-2026-13976

Analysis Generated

Mar 21, 2026 - 01:00 vuln.today

Patch released

Mar 21, 2026 - 01:00 nvd

Patch available

CVE Published

Mar 21, 2026 - 00:42 nvd

MEDIUM 5.4

DescriptionCVE.org

OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool metadata or using non-core read-like names to reach auto-approve paths.

AnalysisAI

OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP (Approval Control Panel) client that automatically approves tool calls based on untrusted metadata and overly permissive heuristics. An authenticated attacker with PR (privileges required) can bypass interactive approval prompts for read-class operations by spoofing toolCall.kind metadata or using non-core read-like function names to reach auto-approve execution paths. This vulnerability enables unauthorized information disclosure and modification without user interaction, and while not currently listed as actively exploited in KEV, proof-of-concept demonstrations are available via vendor security advisories.

Technical ContextAI

The vulnerability stems from a CWE-807 (Reliance on Untrusted Inputs in a Security Decision) flaw in OpenClaw's ACP client, which implements approval workflows for tool invocations. The affected component (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) uses toolCall.kind metadata and name-based heuristics to make automated approval decisions without validating the integrity or trustworthiness of these inputs. The root cause involves insufficient validation of tool metadata before reaching approval decision logic, allowing attackers to manipulate metadata fields (such as tool.kind) or craft function names matching non-core patterns that trigger permissive auto-approval paths. This is particularly dangerous in AI/LLM agent contexts where tool-calling abstractions are used to execute external operations, as the approval layer is intended to be a security boundary.

RemediationAI

Upgrade OpenClaw to version 2026.2.23 or later immediately. The vendor has published two commits addressing the vulnerability (https://github.com/openclaw/openclaw/commit/12cc754332f9a7c92e158ce7644aa22df79c0904 and https://github.com/openclaw/openclaw/commit/63dcd28ae0be2de1c75af09cc81841cebeec068f) which strengthen metadata validation and remove overly permissive approval heuristics. Until patching is feasible, enforce stricter tool approval policies by disabling auto-approval for all tool-calling operations and requiring explicit user confirmation for each invocation, implement network-level access controls to restrict ACP client access to trusted administrative networks only, and audit tool metadata schemas to reject suspicious or non-canonical toolCall.kind values at the API gateway layer.