AI agent vulnerability · OpenClaw

GHSA-4w7m-58cg-cmff: OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries

highCVSS 3.1 8.8

Summary In affected versions of openclaw, sandboxed leaf subagents could still access the subagents control surface and resolve against the parent requester scope instead of remaining confined to their own session tree. Impact A low-privilege sandboxed leaf worker could steer or kill a sibling run owned by the same requester and cause that sibling to execute with its own broader tool policy.

Published Mar 13, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.3.11
Fixed in: 2026.3.11
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

In affected versions of openclaw, sandboxed leaf subagents could still access the subagents control surface and resolve against the parent requester scope instead of remaining confined to their own session tree.

Impact

A low-privilege sandboxed leaf worker could steer or kill a sibling run owned by the same requester and cause that sibling to execute with its own broader tool policy. This is a sandbox and session-scope boundary bypass.

Affected Packages and Versions

Package: openclaw (npm)
Affected versions: <= 2026.3.8
Fixed in: 2026.3.11

Technical Details

Leaf subagents retained the subagents tool, and subagent control requests were authorized against the parent requester scope rather than the caller's own spawned descendants. The control path prevented only self-targeting, not cross-sibling steering.

Fix

OpenClaw now removes subagents control access from leaf subagents by default, scopes subagent control to the caller's own descendants, and rejects steer and kill requests that target runs outside that descendant tree. The fix shipped in [email protected].

Workarounds

Upgrade to 2026.3.11 or later.

Credited to tdjackey.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries