OpenClaw versions prior to 2026.3.28 allow authenticated operator clients to bypass authorization controls by manipulating WebSocket handshake client metadata. The chat.send gateway uses this self‑declared metadata, not the actual authorization state, to gate ACP‑only provenance fields. An attacker can therefore spoof ACP identity labels and inject reserved provenance data intended exclusively for the ACP bridge, potentially masquerading as legitimate system components and influencing downstream processing.

The vulnerability affects the OpenClaw application (vulnerable releases before 2026.3.28). It targets the chat.send gateway exposed by the Node.js‑based OpenClaw runtime and operates in environments where operator clients use WebSocket connections to communicate with the server.

The CVSS score of 7.1 indicates a high risk of exploitation. Although the EPSS score is not available, the exploit requires only an authenticated operator client with WebSocket access, which can be achieved over the internet for publicly reachable OpenClaw instances. The vulnerability is not listed in CISA KEV, but the attack vector involves authenticated network communication and could allow malicious provenance injection if the operator client is compromised or malicious. The impact is a significant authorization bypass that could lead to spoofed messages, data tampering, or inappropriate system interactions.