CVE-2026-32898: OpenClaw ACP bypass enables silent

CISO Take

OpenClaw versions before 2026.2.23 contain an authorization bypass where the ACP client auto-approves tool calls based on untrusted toolCall.kind metadata or permissive name heuristics, completely removing the human approval gate from read-class tool invocations. In AI agent environments where tools access files, credentials, or internal APIs, losing the approval control means malicious or unexpected tool calls execute silently without any human review—directly undermining the principal oversight mechanism organizations rely on for agentic AI governance. Despite a CVSS of 5.4, EPSS places this in the top 83rd percentile for exploitation probability, and the attack requires only low privileges over the network with no user interaction needed. Upgrade to OpenClaw ≥ 2026.2.23 immediately using patches from commits 12cc754 and 63dcd28; as an interim measure, audit all registered tool definitions for read-like naming patterns and enforce strict server-side toolCall.kind validation in ACP configuration.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

CVSS 5.4 (medium) materially understates contextual risk in AI agent deployments. The ACP approval bypass eliminates a human-in-the-loop control that is architecturally central to safe agentic AI operation—not a compensating control but the primary governance mechanism. Exploitation requires only low privileges and network access with no user interaction, making it accessible to any authenticated insider or compromised account. The EPSS 83rd percentile indicates meaningful exploitation interest relative to the broader CVE population. Four downstream dependents limit supply-chain blast radius, but 396 historical CVEs in the same package signal a codebase with systemic security debt warranting scrutiny beyond this specific finding.

How does the attack unfold?

Initial Access

Adversary obtains low-privilege authenticated access to an OpenClaw deployment via valid credentials or a misconfigured API endpoint exposed over the network.

AML.T0012

Metadata Spoofing

Adversary crafts a tool call with toolCall.kind set to a read-class value or registers a tool with a name matching auto-approve heuristics (e.g., 'readConfig', 'getEnv'), exploiting CWE-807 reliance on untrusted input in a security decision.

AML.T0074

Approval Bypass

ACP client evaluates the spoofed metadata or name heuristic, classifies the call as a safe read-class operation, and auto-approves execution without presenting an interactive approval prompt to any human reviewer.

AML.T0107

Silent Exfiltration

The approved tool silently reads credentials, API keys, or configuration data accessible to the agent and returns them to the adversary, with no approval audit trail entry generated for the human oversight record.

AML.T0086

Initial Access

Adversary obtains low-privilege authenticated access to an OpenClaw deployment via valid credentials or a misconfigured API endpoint exposed over the network.

AML.T0012

Metadata Spoofing

Adversary crafts a tool call with toolCall.kind set to a read-class value or registers a tool with a name matching auto-approve heuristics (e.g., 'readConfig', 'getEnv'), exploiting CWE-807 reliance on untrusted input in a security decision.

AML.T0074

Approval Bypass

ACP client evaluates the spoofed metadata or name heuristic, classifies the call as a safe read-class operation, and auto-approves execution without presenting an interactive approval prompt to any human reviewer.

AML.T0107

Silent Exfiltration

The approved tool silently reads credentials, API keys, or configuration data accessible to the agent and returns them to the adversary, with no approval audit trail entry generated for the human oversight record.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A None

What should I do?

6 steps

Upgrade to OpenClaw ≥ 2026.2.23 using patches from commits 12cc754332f9a7c9 and 63dcd28ae0be2de1c.
Audit all registered tool definitions for names containing read-like terms (read, get, fetch, list, query, view, describe) that may match auto-approve heuristics.
Review ACP configuration to enforce strict server-side toolCall.kind validation; never rely on client-supplied kind values for security decisions.
Apply least-privilege to all tool permissions—remove sensitive resource access from tools that do not strictly require it.
Enable verbose audit logging for all tool invocations, including auto-approved ones, and alert on unexpected execution patterns.
Until patched, consider disabling ACP auto-approval entirely and requiring explicit human approval for all tool calls in sensitive environments.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Framework AML.T0053 - AI Agent Tool Invocation AML.T0074 - Masquerading AML.T0084.001 - Tool Definitions AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 14 - Human oversight

ISO 42001

Clause 8.4 - AI system operation and human oversight controls

NIST AI RMF

GOVERN-6.2 - Policies and procedures are in place to allow for human oversight

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32898?

OpenClaw versions before 2026.2.23 contain an authorization bypass where the ACP client auto-approves tool calls based on untrusted toolCall.kind metadata or permissive name heuristics, completely removing the human approval gate from read-class tool invocations. In AI agent environments where tools access files, credentials, or internal APIs, losing the approval control means malicious or unexpected tool calls execute silently without any human review—directly undermining the principal oversight mechanism organizations rely on for agentic AI governance. Despite a CVSS of 5.4, EPSS places this in the top 83rd percentile for exploitation probability, and the attack requires only low privileges over the network with no user interaction needed. Upgrade to OpenClaw ≥ 2026.2.23 immediately using patches from commits 12cc754 and 63dcd28; as an interim measure, audit all registered tool definitions for read-like naming patterns and enforce strict server-side toolCall.kind validation in ACP configuration.

Is CVE-2026-32898 actively exploited?

No confirmed active exploitation of CVE-2026-32898 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32898?

1. Upgrade to OpenClaw ≥ 2026.2.23 using patches from commits 12cc754332f9a7c9 and 63dcd28ae0be2de1c. 2. Audit all registered tool definitions for names containing read-like terms (read, get, fetch, list, query, view, describe) that may match auto-approve heuristics. 3. Review ACP configuration to enforce strict server-side toolCall.kind validation; never rely on client-supplied kind values for security decisions. 4. Apply least-privilege to all tool permissions—remove sensitive resource access from tools that do not strictly require it. 5. Enable verbose audit logging for all tool invocations, including auto-approved ones, and alert on unexpected execution patterns. 6. Until patched, consider disabling ACP auto-approval entirely and requiring explicit human approval for all tool calls in sensitive environments.

What systems are affected by CVE-2026-32898?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent pipelines, human-in-the-loop approval systems, agentic AI deployments.

What is the CVSS score for CVE-2026-32898?

CVE-2026-32898 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent pipelineshuman-in-the-loop approval systemsagentic AI deployments

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0074 Masquerading

AML.T0084.001 Tool Definitions

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 14

ISO 42001: Clause 8.4

NIST AI RMF: GOVERN-6.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool metadata or using non-core read-like names to reach auto-approve paths.

Exploitation Scenario

An attacker with a low-privilege account on an OpenClaw deployment registers a tool named 'readSecrets' or 'getEnvConfig', or crafts a tool call with toolCall.kind set to 'read'. When the AI agent invokes this tool during an autonomous task, the ACP client evaluates the name heuristic or the untrusted kind field, classifies it as a safe read-class operation, and auto-approves execution without presenting an approval prompt to any human reviewer. The tool reads environment variables containing database credentials or API keys accessible in the agent's runtime and returns them to the attacker. This scenario directly mirrors the AIID #1368 incident where malicious OpenClaw skills exfiltrated credentials via ClawHub—except this CVE eliminates the approval mechanism that would have surfaced the suspicious skill to a human reviewer before execution.

Weaknesses (CWE)

CWE-807 Reliance on Untrusted Inputs in a Security Decision

CWE-807 — Reliance on Untrusted Inputs in a Security Decision: The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

[Architecture and Design] Store state information and sensitive data on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions. If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. With a stateless protocol such as HTTP, use a framework that maintains the state for you. Examples include ASP.NET View State [REF-756] and the OWASP ESAPI Session Management feature [REF-45]. Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.

Source: MITRE CWE corpus.