EUVD-2026-21470Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates a network-accessible vulnerability requiring low privileges and no user interaction, with low attack complexity. However, the integrity impact (I:L) is limited to message content alteration within the agent framework, and confidentiality and availability are not affected. The requirement for authenticated access (PR:L) moderates the overall risk, as an attacker must already possess valid subagent credentials. The CVSS score of 4.3 reflects this as a medium-low severity issue. No EPSS score, KEV status, or public exploit code availability data was provided, suggesting this is a recently disclosed vulnerability not yet tracked by CISA or widely exploited. The real-world risk depends on deployment scope-organizations with multi-tenant or sensitive agent hierarchies should prioritize patching, while those with limited subagent trust boundaries face lower exposure. This is a legitimate authorization bypass requiring existing credentials, not a critical unauthenticated remote code execution. |
| Exploit ScenarioDerived | An attacker with valid subagent credentials in a multi-tenant OpenClaw deployment can invoke the send action to transmit messages to child sessions outside their authorized controlScope. For example, a subagent assigned to manage only sessions in Domain A could bypass restrictions and message sessions in Domain B, potentially exfiltrating data or manipulating agent workflows. Because the attack requires authenticated access and low network complexity, it represents a privilege escalation within the agent hierarchy rather than a standalone remote attack vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
OpenClaw before version 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing authenticated leaf subagents to bypass access control and message child sessions beyond their authorized scope. An authenticated attacker with subagent privileges can exploit this via the send action to communicate with restricted child sessions without proper validation, resulting in unauthorized inter-session message relay. No public exploit code has been identified, but the vulnerability has a moderate CVSS score of 4.3 reflecting the integrity impact and low attack complexity.
RemediationAI
Vendor-released patch: Upgrade to OpenClaw version 2026.3.22 or later. The fix has been implemented in two commits: 630f1479c44f78484dfa21bb407cbe6f171dac87 and 7679eb375294941b02214c234aff3948796969d0, which restore proper controlScope validation in the send action handler. Operators should apply the update immediately, particularly in environments where subagent isolation is a security requirement. For environments unable to patch immediately, restrict the privileges of leaf subagents or implement network-level message filtering to prevent unauthorized child session communication. Consult the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-x2cm-hg9c-mf5w for detailed mitigation guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw is a multi-agent orchestration platform that uses controlScope restrictions to enforce access control boundaries between agent hierarchies. The vulnerability exists in the send action handler, which is responsible for message routing between parent agents and their child sessions. The root cause is classified under CWE-862 (Missing Authorization), indicating a failure in the access control enforcement logic. When leaf subagents invoke the send action, the platform does not validate whether the target child session is within the subagent's authorized controlScope, allowing scope boundaries to be circumvented. This affects all versions of OpenClaw prior to 2026.3.22, as identified by the CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*, meaning any version before the patched release is vulnerable.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond their authorized scope. Attackers can exploit this by using the send action to communicate with child sessions without proper scope validation, bypassing intended access control restrictions.
Blast Radius
ecosystem impact- 5 npm packages depend on openclaw (5 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.22.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in OpenClaw Multiple Authorization and Privilege Escalation
View all 29Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB