Beveiligingsadvies

CVE-2026-32898

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-03-21 00:42:33

Laatst bijgewerkt 2026-06-23 16:15:13

Toegewezen door VulnCheck

CVSS-score 5.4

Status PUBLISHED

Beschrijving

OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool metadata or using non-core read-like names to reach auto-approve paths.

← Alle CVE's bekijken Bekijk op cve.org ↗