Is there a patch available for CVE-2026-44997?

Yes, a patch is available for CVE-2026-44997. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-44997

Q: What is the CVSS score of CVE-2026-44997?

CVE-2026-44997 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29142 LOW

Incorrect Privilege Assignment (CWE-266)

2026-05-11 VulnCheck

GHSA-w626-296m-8f85

Authentication Bypass Openclaw

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 18:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 18:22 NVD

4.3 (MEDIUM) 2.3 (LOW)

Source Code Evidence Fetched

May 11, 2026 - 17:48 vuln.today

Analysis Generated

May 11, 2026 - 17:48 vuln.today

CVE Published

May 11, 2026 - 16:46 nvd

MEDIUM 4.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.22.

DescriptionCVE.org

OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to inherit depth, child-count limits, control scope, or target-agent restrictions. Attackers can exploit this by spawning child sessions that bypass subagent-only constraints, potentially escalating privileges or accessing restricted resources.

AnalysisAI

OpenClaw before 2026.4.22 fails to propagate security envelope constraints when spawning ACP child sessions, allowing authenticated restricted subagents to bypass depth limits, child-count restrictions, control scope, and target-agent constraints. An attacker with subagent privileges can exploit this by spawning child sessions that inherit insufficient security enforcement, potentially escalating privileges or accessing resources beyond their assigned scope.

Technical ContextAI

OpenClaw is a Node.js agent orchestration framework (npm package) that manages restricted subagent execution through a security envelope model. The vulnerability exists in the ACP (Agent Control Protocol) child session spawning mechanism, which failed to resolve and persist subagent-specific envelope fields (maxSpawnDepth, maxChildrenPerAgent, control scope, allowAgents allowlist) from parent subagent configurations to newly spawned child sessions. The root cause is improper constraint inheritance in the session initialization logic, allowing child sessions to operate without inherited policy boundaries. CWE-266 (Incorrect Privilege Assignment) applies because subagents fail to retain privilege restrictions intended by their security envelope definition.

RemediationAI

Upgrade OpenClaw to version 2026.4.22 or later immediately, as the vendor-released patch is available on npm. The fix resolves constraint inheritance by enforcing ACP spawn to resolve and persist child subagent envelope fields, enforce maximum depth and active-child caps, and apply inherited control scope to child ACP sessions. Users running OpenClaw 2026.4.21 or earlier should execute 'npm update openclaw@^2026.4.22' in their deployment environments. Verify the upgrade by checking the compiled package contains commit 31160dc069b7cc5d833b39c53736a41ad3befda2. As a temporary compensating control (if immediate patching is infeasible), administrators should restrict network access to OpenClaw agent endpoints and audit logs for suspicious child session spawns from subagent-level accounts; however, this does not prevent local exploitation and should not replace patching.