CVE-2026-35655CWE-807

OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution

Medium · published April 10, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.22 contains an identity spoofing vulnerability in ACP permission resolution that trusts conflicting tool identity hints from rawInput and metadata. Attackers can spoof tool identities through rawInput parameters to suppress dangerous-tool prompting and bypass security restrictions.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-807 · Reliance on Untrusted Inputs in a Security Decision
Published
2026-04-10T16:03Z
EPSS history
Timeline
  • 10 APR 16:03Z
    OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution
    cvelistv5