Openclaw CVE-2026-35655

This vulnerability presents moderate real-world risk despite a medium CVSS score (5.7). The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) indicates network-accessible attack requiring low complexity and a user interaction (UI:R), but the high integrity impact (I:H) reflects the ability to bypass intended security controls. Authentication is required (PR:L), limiting the attack surface to authenticated users. The integrity-focused impact (no confidentiality or availability loss) aligns with an authorization bypass rather than data theft or service disruption. Given that dangerous-tool prompting is a primary security boundary in OpenClaw, and authenticated users can silently circumvent it, this represents a meaningful privilege escalation or policy violation risk for multi-tenant or role-based environments. The CVSS does not fully capture the severity in contexts where tool execution audit trails or compliance depend on accurate tool attribution. Exploitation likelihood is moderate: requires authenticated access and user interaction, but once triggered, is reliably weaponizable for operations that should be blocked.

An authenticated OpenClaw user with legitimate access to benign tools crafts a request containing a rawInput parameter that falsely claims the tool identity as a safe utility (e.g., 'read_file') while the actual metadata payload performs a dangerous operation (e.g., 'execute_shell'). The ACP permission system trusts the rawInput hint over metadata, suppresses the dangerous-tool warning that would normally trigger user interaction (UI:R requirement), and permits the operation silently. No public exploit code has been confirmed, but the straightforward nature of parameter manipulation makes this readily weaponizable once an attacker understands the permission resolution logic.