Executive brief
OpenClaw is a library used for managing subagents and automated sessions. A vulnerability was found where restricted subagents could create new child sessions that do not inherit the security restrictions of the parent. This could allow an attacker to bypass operational limits, such as how many child processes can be created or which resources they can access, potentially leading to unauthorized resource usage or privilege escalation.
Technical details
A vulnerability in OpenClaw (npm package) prior to version 2026.4.22 allows restricted subagents to spawn ACP child sessions that fail to inherit security envelope constraints. Specifically, child sessions do not carry forward depth limits, child-count caps, control scopes, or target-agent restrictions from the parent subagent. An attacker with low privileges can exploit this over the network to bypass subagent-only constraints, potentially escalating privileges or accessing restricted resources. The fix, implemented in version 2026.4.22, ensures that ACP spawn operations resolve and persist child subagent envelope fields and enforce maximum depth and active-child caps.
Affected products
- OpenClaw openclaw < 2026.4.22
Timeline
- 2026-04-21: patched: Fix commit 31160dc authored.
- 2026-05-11: advisory: Original advisory published.
- 2026-05-18: other: Advisory withdrawn as a duplicate of GHSA-q3jj-46pq-826r.