Vulnerability Description
OpenClaw before 2026.3.22 contains an identity spoofing vulnerability in ACP permission resolution that trusts conflicting tool identity hints from rawInput and metadata. Attackers can spoof tool identities through rawInput parameters to suppress dangerous-tool prompting and bypass security restrictions.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.3.22 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dPatch
- https://github.com/openclaw/openclaw/commit/e4c61723cd2d530680cc61789311d464ab8cPatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-74wf-h43j-vvmjVendor Advisory
- https://www.vulncheck.com/advisories/openclaw-identity-spoofing-via-rawinput-tooThird Party Advisory
FAQ
What is CVE-2026-35655?
CVE-2026-35655 is a vulnerability with a CVSS score of 5.7 (MEDIUM). OpenClaw before 2026.3.22 contains an identity spoofing vulnerability in ACP permission resolution that trusts conflicting tool identity hints from rawInput and metadata. Attackers can spoof tool iden...
How severe is CVE-2026-35655?
CVE-2026-35655 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35655?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.