N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7jx5-9fjg-hp4m

GHSA-7jx5-9fjg-hp4m: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

Vulnerability Summary

The OpenClaw ACP client could auto-approve tool calls based on untrusted metadata and permissive name heuristics. A malicious or compromised ACP tool invocation could bypass expected interactive approval prompts for read-class operations.

Affected Packages / Versions

Package: npm openclaw
Affected published versions: <= 2026.2.22-2 (latest published as of February 24, 2026 is 2026.2.22-2)
Patched in code on main: 2026.2.23 (released)

Technical Details

Permission classification trusted incoming toolCall.kind and heuristic name matching.
Non-core read-like names and spoofed kind metadata could reach auto-approve paths.
read operations were not scoped strongly enough to cwd in all metadata/title forms.

Fix

Require trusted core tool IDs for auto-approval and ignore untrusted toolCall.kind as an authorization source.
Scope read auto-approval to cwd-resolved paths.
Add stricter tool-name validation and regression coverage for spoofed kind and non-core read-like names.

Affected Functions

resolvePermissionRequest
resolveToolNameForPermission
shouldAutoApproveToolCall

Fix Commit(s)

12cc754332f9a7c92e158ce7644aa22df79c0904
63dcd28ae0be2de1c75af09cc81841cebeec068f

Found using MCPwner

Thanks @nedlir for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7jx5-9fjg-hp4m

GHSA-7jx5-9fjg-hp4m:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.22-2	2026.2.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the OpenClaw ACP client's permission auto-approval mechanism. The root cause is that the client trusted untrusted data from the connected tool server and used weak heuristics to classify operations as 'safe' for auto-approval.

Specifically, the analysis of the patches reveals two main flaws:

Untrusted Metadata and Weak Heuristics: The function resolveToolKindForPermission would determine if an operation was safe (e.g., a 'read' or 'search'). It did this by first checking a kind property sent by the server, which a malicious server could easily spoof. If the kind was not present, it fell back to insecure string matching on the tool's name. This allowed a malicious tool with a name like fs_read_secrets to be misclassified as a safe 'read' operation, bypassing user approval.
Unscoped File Access: For 'read' operations that were auto-approved, there were no checks to ensure the file path was within the user's current working directory. This meant a malicious tool could request to read sensitive files outside the intended scope (e.g., ~/.ssh/id_rsa) and have it be auto-approved without a prompt.

The fix, implemented across two commits, addresses these issues comprehensively. The resolvePermissionRequest function was refactored to use a new, much stricter shouldAutoApproveToolCall function. This new function no longer trusts the kind property and instead verifies the tool's ID against a hardcoded allowlist of trusted core tools. Furthermore, for the read tool, it now performs strict path validation to ensure any file access is scoped to the current working directory, preventing directory traversal attacks. Finally, the validation for tool names themselves was hardened to prevent parsing-related bypasses.

Vulnerable functions

resolvePermissionRequest

src/acp/client.ts

This function contained the primary vulnerable logic. It used the output of the weak `resolveToolKindForPermission` function to decide whether to auto-approve a tool execution. A malicious input could result in `isSafeKind` being true, which would set `promptRequired` to false, thus bypassing the user prompt and leading to unauthorized action.

resolveToolKindForPermission

src/acp/client.ts

The pre-patch version of this function was vulnerable because it trusted untrusted data. It would first trust the `toolCall.kind` property if present, which could be spoofed by a malicious server. If not present, it would fall back to insecure heuristic matching on the tool name (e.g., checking if 'read' is a substring). This allowed non-core or malicious tools to be misclassified as safe, leading to an auto-approval bypass.

shouldAutoApproveToolCall

src/acp/client.ts

This function was added in the patch to fix the vulnerability. The vulnerability existed in the *absence* of this function's logic. The previous logic, which was inline in `resolvePermissionRequest`, was to simply check the tool's 'kind'. This new function replaces that with a much stricter policy: it verifies the tool against a list of trusted core tool IDs and, for 'read' operations, ensures the file path is safely scoped within the current working directory.

resolveToolNameForPermission

src/acp/client.ts

This function, via its dependency on `normalizeToolName`, was too permissive in what it considered a valid tool name. The lack of strict validation on the characters and length of the tool name could be abused. A crafted name could potentially bypass the parser or other security checks that rely on a well-formed tool name, contributing to the permission bypass. The patch added strict pattern and length validation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-7jx5-9fjg-hp4m: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

Vulnerability Summary

Affected Packages / Versions

Technical Details

Fix

Affected Functions

Fix Commit(s)

GHSA-7jx5-9fjg-hp4m:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

GHSA-7jx5-9fjg-hp4m: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

Vulnerability Summary

Affected Packages / Versions

Technical Details

Fix

Affected Functions

Fix Commit(s)

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI