Executive brief
OpenClaw is a distributed system for spawning and managing agent processes with security constraints. A flaw allows restricted subagents to spawn child sessions that fail to inherit security boundaries (depth limits, child-count restrictions, control scope, and target-agent constraints), potentially enabling privilege escalation and unauthorized access to restricted resources.
Technical details
OpenClaw before version 2026.4.22 contains an improper privilege restriction vulnerability (CWE-266) in its ACP child session spawning mechanism. When a restricted subagent spawns an ACP child session, the session fails to inherit critical security envelope constraints such as depth limits, child-count caps, control scope, or target-agent restrictions. An attacker with subagent access can exploit this by spawning child sessions that bypass subagent-only constraints, potentially escalating to unrestricted operations or accessing protected resources. The vulnerability requires authenticated access (subagent credentials) to trigger. The fix (version 2026.4.22) resolves and persists child subagent envelope fields, enforces maximum depth and active-child caps, and applies inherited control scope to child ACP sessions.
Affected products
- OpenClaw OpenClaw <2026.4.22
Timeline
- 2026-04-23: disclosed
- 2026-04-23: patched: Version 2026.4.22 released
- 2026-05-11: advisory: Original advisory published as GHSA-q3jj-46pq-826r; GHSA-w626-296m-8f85 marked as duplicate