Sign in
Deutsch English Español Polski
High

OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization

  • Disclosed: 03.03.2026
  • Updated: 11.10.2026 10:22

Summary

Sandboxed sessions_spawn(runtime="acp") could bypass sandbox inheritance and initialize host-side ACP runtime. The fix now fail-closes ACP spawn from sandboxed requester sessions and rejects sandbox="require" for runtime="acp".

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published npm version at triage time: 2026.3.1 (March 2, 2026)
  • Vulnerable range: <=2026.3.1
  • Patched release: 2026.3.2 (released)

Technical Details

  • Root cause: runtime="subagent" enforced sandbox inheritance, while runtime="acp" did not enforce equivalent sandbox/runtime checks.
  • Security impact: sandbox-boundary bypass into host-side ACP initialization.
  • Fixed behavior:
    • deny ACP spawn when requester runtime is sandboxed
    • deny sessions_spawn with runtime="acp", sandbox="require"
    • align sandboxed prompt guidance to avoid advertising blocked ACP paths

Fix Commit(s)

  • ac11f0af731d41743ba02d8595f4d0fe747336e3
  • c703aa0fe92df9fb71cf254fc46991e05fba2114

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package openclaw < 2026.3.2 2026.3.2

References

CVSS score 8/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-269
Platform
npm
Package
openclaw
Disclosed
03.03.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-474h-prjg-mmw3 - CC BY 4.0

Vulnerability history: openclaw

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (588) in the archive
Total entries
588
First → latest
02.2026 07.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 20
  • High 215
  • Medium 299
  • Low 54

Disclosures per year

Severity:
  1. OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization this entry
    High · 8.0 ghsa-474h-prjg-mmw3 < 2026.3.2 2026.3.2
  2. OpenClaw: Native command authorization could skip owner-command enforcement
    High CVE-2026-53828 < 2026.5.6 2026.5.6
  3. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    High · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  4. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    High CVE-2026-53839 < 2026.5.7 2026.5.7
  5. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    High CVE-2026-53807 < 2026.5.6 2026.5.6
  6. OpenClaw: Matrix allowFrom could bind to mutable display names
    High · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  7. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    High · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  8. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    High · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  9. OpenClaw: Fake package roots could influence memory-core artifact loading
    High · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  10. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    High · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  11. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    High · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  12. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    High · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  13. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Critical CVE-2026-34507 < 2026.4.29 2026.4.29
  14. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    High · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  15. OpenClaw: Slack allowFrom could bind to mutable display names
    High CVE-2026-53823 < 2026.5.3 2026.5.3
  16. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    High · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  17. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    High · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  18. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    High · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  19. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    High · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  20. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    High · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  21. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    High · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  22. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    High · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  23. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    High · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  24. OpenClaw: Shell wrapper argv could change between approval and execution
    High CVE-2026-53822 < 2026.5.18 2026.5.18
  25. OpenClaw: Exec approval display truncation could hide the command being approved
    High · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  26. OpenClaw: Message read actions could skip channel allowlist checks
    High · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  27. OpenClaw: Workspace-derived service PATH could influence trash command selection
    High · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  28. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    High · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  29. OpenClaw: Discord allowFrom could bind to mutable display names
    High · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  30. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    High · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  31. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    High · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  32. OpenClaw: Zalo allowFrom could bind to mutable display names
    High · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  33. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    High · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  34. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    High · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  35. OpenClaw: Shell inline-command parsing could miss an allowlist check
    High · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  36. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    High · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  37. OpenClaw: Host environment sanitizer missed two Node.js control variables
    High · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  38. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    High · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  39. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    High · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  40. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    High · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  41. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    High · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
Show more (20) Showing 41 of 235

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.