PT-2026-31966 · Openclaw · Openclaw
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.3.22
Description
The software contains an identity spoofing issue in ACP permission resolution. The system incorrectly trusts conflicting tool identity hints from rawInput and metadata, potentially suppressing dangerous-tool prompting. Attackers can exploit this by spoofing tool identities through the
rawInput parameters, bypassing security restrictions.Recommendations
Update to version 2026.3.22 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw