GHSA-474h-prjg-mmw3

OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization

High npm

Severity: 8.0 / 10; High · CVSS 3.1
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-269 Improper Privilege Management
Fix: 2026.3.2; Upgrade openclaw to this version or later

Description

Summary

Sandboxed sessions_spawn(runtime="acp") could bypass sandbox inheritance and initialize host-side ACP runtime. The fix now fail-closes ACP spawn from sandboxed requester sessions and rejects sandbox="require" for runtime="acp".

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version at triage time: 2026.3.1 (March 2, 2026)
Vulnerable range: <=2026.3.1
Patched release: 2026.3.2 (released)

Technical Details

Root cause: runtime="subagent" enforced sandbox inheritance, while runtime="acp" did not enforce equivalent sandbox/runtime checks.
Security impact: sandbox-boundary bypass into host-side ACP initialization.
Fixed behavior:
- deny ACP spawn when requester runtime is sandboxed
- deny sessions_spawn with runtime="acp", sandbox="require"
- align sandboxed prompt guidance to avoid advertising blocked ACP paths

Fix Commit(s)

ac11f0af731d41743ba02d8595f4d0fe747336e3
c703aa0fe92df9fb71cf254fc46991e05fba2114

Affected versions

npm

Package	Vulnerable	Fixed in
openclaw	`< 2026.3.2`	`2026.3.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

openclaw npm → `2026.3.2`

npm

npm install openclaw@2026.3.2

yarn

yarn add openclaw@2026.3.2

pnpm

pnpm add openclaw@2026.3.2

Severity breakdown

CVSS 3.1 8.0

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: High
Privileges required: High
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-269: Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

References

Packages

github.com/openclaw/openclaw

Timeline

Mar 3, 2026 Published
Mar 4, 2026 Last updated by the source

Advisory	Severity	Why it's related
GHSA-3x84-qq85-fj65 OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs	High	Also affects openclaw
GHSA-9c3v-684m-579c OpenClaw MCP SSE redirects could forward Authorization headers	Medium	Also affects openclaw
GHSA-f397-5vjw-v2c2 OpenClaw: Shell inline-command parsing could miss an allowlist check	High	Also affects openclaw
GHSA-rx78-29qr-5hq8 OpenClaw: Workspace-derived service PATH could influence trash command selection	High	Also affects openclaw
GHSA-ccwh-wwpp-6wg5 OpenClaw: Host environment sanitizer missed two Node.js control variables	High	Also affects openclaw
GHSA-985f-72mj-8gf7 OpenClaw: Tool group policy callers could accept unvalidated group IDs	Medium	Also affects openclaw
GHSA-9v8j-9c9g-w66c OpenClaw: Bootstrap token replay could widen pending pairing scopes	Medium	Also affects openclaw
GHSA-c226-q6fx-6j6c OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags	Medium	Also affects openclaw

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor