OpenClaw versions before 2026.2.23 contain an authorization bypass in the ACP client that auto‑approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. An attacker can spoof the tool metadata or supply non‑core read‑like names to trigger auto‑approve paths, thereby bypassing the interactive approval prompts for read‑class operations. The consequence is the ability to perform unauthorized read operations that the user would normally have to confirm, potentially exposing sensitive data. The weakness aligns with a privilege‑check bypass, classified as CWE‑807.

The affected product is OpenClaw from the OpenClaw vendor. All releases prior to version 2026.2.23 are impacted; upgrading to 2026.2.23 or later resolves the issue.

The CVSS score of 5.3 indicates a moderate severity vulnerability. EPSS data is unavailable, and the vulnerability is not listed in KEV, suggesting no known widespread exploitation yet. Nevertheless, the flaw can be exploited remotely by submitting a crafted toolCall with malicious or fabricated kind metadata. The requirements are minimal – access to submit tool calls – and the attacker can achieve unauthorized data reads without overcoming interactive prompts. Due to the moderate severity and potential for data leakage, it is advisable to remediate promptly.