Openclaw cli: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata (CVE-2026-32898)

CVE-2026-32898 affects the OpenClaw ACP client (npm package openclaw) versions from 2026.1.29 up to but not including 2026.2.23. The vulnerability arises because the client trusted incoming toolCall.kind metadata and used heuristic name matching to auto-approve permission requests. Non-core read-like names and spoofed kind metadata could bypass interactive approval prompts for read operations. The fix involved ignoring untrusted toolCall.kind values, requiring trusted core tool IDs for auto-approval, scoping read auto-approval to current working directory resolved paths, and adding stricter tool-name validation.

An attacker controlling or compromising an ACP tool invocation could bypass expected interactive permission approval prompts for read-class operations, potentially allowing unauthorized read access. The CVSS 3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact without availability impact.

A patch is available and was released in version 2026.2.23. Users should upgrade to version 2026.2.23 or later to remediate this vulnerability. The fix removes reliance on untrusted metadata for auto-approval and enforces stricter validation and scoping of read permissions.