Vulnerability Description
OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt payloads before forwarding them to chat.send. Because ACP runs over local stdio, this mainly affects local ACP clients (for example IDE integrations) that send unusually large inputs. This issue has been fixed in version 2026.2.19.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | <= 2026.2.17 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/63e39d7f57ac4ad4a5e38d17e7394ae7c4ddPatch
- https://github.com/openclaw/openclaw/commit/8ae2d5110f6ceadef73822aa3db194fb60d2Patch
- https://github.com/openclaw/openclaw/commit/ebcf19746f5c500a41817e03abecadea8655Patch
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.19Release Notes
- https://github.com/openclaw/openclaw/security/advisories/GHSA-cxpw-2g23-2vgwVendor Advisory
FAQ
What is CVE-2026-27576?
CVE-2026-27576 is a vulnerability with a CVSS score of 4.0 (MEDIUM). OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble oversized prompt payloads before forwarding them to chat.sen...
How severe is CVE-2026-27576?
CVE-2026-27576 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27576?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.