Executive brief
OpenClaw is an agent-based development platform that uses various tools to perform coding tasks. A security flaw allowed certain bundled tools (MCP and LSP) to bypass safety restrictions and access policies set by administrators. This means an authorized user could potentially use restricted tools or perform actions that should have been blocked by the system's security profiles, though it requires the user to already have access to the local agent.
Technical details
A tool policy bypass vulnerability exists in OpenClaw due to incorrect authorization logic (CWE-863) where bundled MCP and LSP tools were appended to the effective tool set after the primary policy filtering pipeline had completed. This allowed these tools to bypass profile policies, allow/deny lists, owner-only restrictions, and sandbox policies. An attacker with local agent access and low privileges can exploit this to execute restricted tools. The fix, introduced in version 2026.4.20, implements a final effective tool policy pass specifically for bundled tools and hardens authorization signals to prevent spoofing of owner or group identities.
Affected products
- OpenClaw openclaw < 2026.4.20
Timeline
- 2026-04-17: patched: Fix commit 0e7a992d3f3155199c1acc2dd9a53c5b3a4d3ada merged.
- 2026-04-21: advisory: GitHub Security Advisory GHSA-qrp5-gfw2-gxv4 published.
- 2026-05-11: disclosed: CVE-2026-44998 published.