Executive brief
OpenClaw is an agentic AI framework. A vulnerability was found where certain sub-agents could bypass security restrictions to send unauthorized messages to child sessions they should not have access to. This could allow an attacker with low-level access to interfere with or manipulate other active AI sessions within the system.
Technical details
A missing authorization check in OpenClaw allows leaf subagents to bypass 'controlScope' restrictions. Specifically, subagents could use the 'send' action to message controlled child sessions even when their scope was configured to be narrower than 'children'. The vulnerability was rooted in 'src/auto-reply/reply/commands-subagents/action-send.ts' and 'src/agents/subagent-control.ts', where controller context was not properly validated against the target session ownership. Attackers with network access and low privileges can exploit this to perform unauthorized modifications of system data or session states. The issue is fixed in version 2026.3.22 by enforcing ownership and scope checks during the send path.
Affected products
- openclaw openclaw < 2026.3.22
Timeline
- 2026-03-24: patched: Fix shipped in v2026.3.22
- 2026-03-26: disclosed: GitHub Advisory published
- 2026-04-10: advisory: NVD published the CVE