PT-2026-31966 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-26 · Updated 2026-04-10 · CVE-2026-35655

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22

Description The software contains an identity spoofing issue in ACP permission resolution. The system incorrectly trusts conflicting tool identity hints from rawInput and metadata, potentially suppressing dangerous-tool prompting. Attackers can exploit this by spoofing tool identities through the rawInput parameters, bypassing security restrictions.

Recommendations Update to version 2026.3.22 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-807

CWE-863

Related Identifiers

CVE-2026-35655

GHSA-74WF-H43J-VVMJ

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-74wf-h43j-vvmj · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/e4c61723cd2d530680cc61789311d464ab8cdf60 · Patch
• https://osv.dev/vulnerability/GHSA-74wf-h43j-vvmj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35655 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2042710259026841782 · Twitter Post
• https://vulncheck.com/advisories/openclaw-identity-spoofing-via-rawinput-tool-in-acp-permission-resolution · Note