Executive brief
OpenClaw is an orchestration framework for managing agent conversations and workflows. A flaw in how it handles inter-session message routing could allow one delegated or internal session to inject instructions into another session in a way that bypasses security checks, because the injected instructions were incorrectly marked as direct user input instead of being tagged with their true source. This could lead to unintended privileged operations if the system trusts user-originated messages for authorization decisions.
Technical details
This is an instruction-provenance confusion vulnerability (CWE-345, confused-deputy style). Inter-session prompts routed via sessions_send were persisted with role: "user" but without provenance metadata, making them indistinguishable from externally-originated user input. Downstream workers and transcript readers could not verify the true source of the message, allowing a delegated or internal session to inject instructions that appeared equivalent to end-user commands. The fix adds an explicit inputProvenance model with kind values (including "inter_session") that are persisted on messages and enforced by transcript readers and memory helpers. The vulnerability required access to sessions_send functionality but did not require authentication bypass or user interaction. Patched in version 2026.2.13.
Affected products
- OpenClaw openclaw <= 2026.2.12
Timeline
- 2026-02-18: disclosed
- 2026-02-13: patched: Version 2026.2.13 released