8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-474h-prjg-mmw3

GHSA-474h-prjg-mmw3: OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization

Summary

Sandboxed sessions_spawn(runtime="acp") could bypass sandbox inheritance and initialize host-side ACP runtime. The fix now fail-closes ACP spawn from sandboxed requester sessions and rejects sandbox="require" for runtime="acp".

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version at triage time: 2026.3.1 (March 2, 2026)
Vulnerable range: <=2026.3.1
Patched release: 2026.3.2 (released)

Technical Details

Root cause: runtime="subagent" enforced sandbox inheritance, while runtime="acp" did not enforce equivalent sandbox/runtime checks.
Security impact: sandbox-boundary bypass into host-side ACP initialization.
Fixed behavior:
- deny ACP spawn when requester runtime is sandboxed
- deny sessions_spawn with runtime="acp", sandbox="require"
- align sandboxed prompt guidance to avoid advertising blocked ACP paths

Fix Commit(s)

ac11f0af731d41743ba02d8595f4d0fe747336e3
c703aa0fe92df9fb71cf254fc46991e05fba2114

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-474h-prjg-mmw3

GHSA-474h-prjg-mmw3:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.1	2026.3.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a sandbox escape in OpenClaw's sessions_spawn functionality. The root cause lies in the spawnAcpDirect function, which, when called with runtime="acp", would create a new session on the host system without checking if the original request came from an already sandboxed session. This allowed a process within a sandbox to break out and execute with host-level privileges.

The analysis of the provided patches identified three key functions involved:

spawnAcpDirect in src/agents/acp-spawn.ts: This is the core of the vulnerability. The patch adds explicit checks to determine if the calling session is sandboxed. If it is, the function now returns a 'forbidden' error, preventing the sandbox escape.
createSessionsSpawnTool in src/agents/tools/sessions-spawn-tool.ts: This function acts as an entry point for using the sessions_spawn tool. It was vulnerable because it failed to propagate the necessary sandbox context to spawnAcpDirect. The patch rectifies this by passing the sandbox status, allowing spawnAcpDirect to enforce the new security policy.
buildAgentSystemPrompt in src/agents/system-prompt.ts: This function contributed to the exploitability of the vulnerability by generating prompts that guided users and agents to use the vulnerable runtime="acp" option, even within a sandbox. The patch modifies this function to remove this misleading guidance in sandboxed environments, thus reducing the likelihood of accidental or intentional exploitation.

During an exploit, a profiler would likely show calls to createSessionsSpawnTool followed by spawnAcpDirect, where the sandbox bypass occurs. Therefore, these functions are critical indicators of this vulnerability being triggered.

Vulnerable functions

spawnAcpDirect

src/agents/acp-spawn.ts

The `spawnAcpDirect` function was missing critical security checks. It did not verify whether the session requesting to spawn a process with `runtime="acp"` was itself running in a sandbox. This allowed a sandboxed session to create a new session that executed outside the sandbox on the host system, leading to a sandbox escape. The patch introduces checks to detect if the requester is sandboxed and, if so, forbids the ACP session from being spawned.

createSessionsSpawnTool

src/agents/tools/sessions-spawn-tool.ts

This function is responsible for creating the `sessions_spawn` tool. Before the patch, it did not pass the `sandbox` options and the `sandboxed` context of the requester to the `spawnAcpDirect` function. This omission meant that `spawnAcpDirect` did not have the necessary information to perform its security checks. The patch corrects this by forwarding the required context, enabling the fix in `spawnAcpDirect` to work correctly.

buildAgentSystemPrompt

src/agents/system-prompt.ts

This function generates system prompts that guide users and AI agents on how to use the available tools. Before the patch, it would incorrectly suggest using `sessions_spawn` with `runtime="acp"` even when inside a sandboxed environment. This misleading guidance could lead to an unintentional or malicious exploitation of the sandbox escape vulnerability in `spawnAcpDirect`. The patch ensures that this guidance is removed for sandboxed sessions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.