N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-qrp5-gfw2-gxv4

GHSA-qrp5-gfw2-gxv4: OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: < 2026.4.20
Patched version: 2026.4.20

Impact

Bundled MCP and LSP tools could be appended to the agent's effective tool set after the normal tool-policy pipeline had already filtered core tools. If an operator configured a restrictive policy, such as a tool profile, explicit allow/deny list, owner-only tool restriction, sandbox tool policy, or subagent tool policy, a bundled MCP/LSP tool could remain available even though the same policy would have denied it.

The issue required a configured bundled MCP or LSP tool source and an operator policy that should have restricted that tool. This was a local agent policy-enforcement bypass, not an unauthenticated remote gateway compromise. Severity is medium.

Fix

OpenClaw now applies a final effective tool policy pass to bundled MCP/LSP tools before merging them into the tool set used by normal runs and compaction. The pass covers profile policy, provider profile policy, global/agent/group policies, owner-only filtering, sandbox tool policy, and subagent tool policy.

Fix commit:

0e7a992d3f3155199c1acc2dd9a53c5b3a4d3ada

Release

Fixed in OpenClaw 2026.4.20.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-qrp5-gfw2-gxv4

GHSA-qrp5-gfw2-gxv4:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.4.20	2026.4.20

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-qrp5-gfw2-gxv4, is a tool policy bypass in OpenClaw. The root cause was that bundled MCP (Mission Control Protocol) and LSP (Language Server Protocol) tools were not being filtered by the same security policies as core tools. My analysis of the fix commit, 0e7a992d3f3155199c1acc2dd9a53c5b3a4d3ada, reveals two main points of failure.

First, in the runEmbeddedAttempt and compactEmbeddedPiSessionDirect functions, the list of effective tools was assembled by simply concatenating the core tools with the bundled tools. This happened before any policy filtering was applied to the bundled tools, effectively allowing them to bypass any configured allow/deny lists, owner-only restrictions, or sandbox policies.

Second, a related authorization vulnerability was found in the sendHandlers.message.action gateway method. This method trusted a user-provided senderIsOwner flag, which could be manipulated by a non-admin user to gain access to restricted, owner-only tools. The patch hardens this by validating the caller's administrative scope on the server side before honoring the senderIsOwner flag.

The fix involves introducing a new function, applyFinalEffectiveToolPolicy, which is now explicitly called to filter the bundled tools before they are added to the effective toolset in both runEmbeddedAttempt and compactEmbeddedPiSessionDirect. This ensures that all tools, regardless of their source, are subjected to the same rigorous policy checks.

Vulnerable functions

compactEmbeddedPiSessionDirect

src/agents/pi-embedded-runner/compact.ts

This function was responsible for creating the list of effective tools during a 'compaction' run. It directly concatenated bundled MCP/LSP tools to the core tool list without applying any of the configured security policies (allow/deny lists, owner-only restrictions, etc.). This allowed a policy bypass where restricted tools could remain available for use.

runEmbeddedAttempt

src/agents/pi-embedded-runner/run/attempt.ts

Similar to 'compactEmbeddedPiSessionDirect', this function constructs the list of available tools for a normal agent run. It vulnerably merged bundled tools into the effective tool set without filtering them against the agent's tool policy, allowing tools that should have been restricted to remain active.

sendHandlers.message.action

src/gateway/server-methods/send.ts

This gateway method handler for 'message.action' had an authorization flaw where it improperly trusted the 'senderIsOwner' flag from the request. A non-admin caller could set this flag to 'true' in their request to bypass authorization and gain access to owner-only tools. The patch rectifies this by ensuring the 'senderIsOwner' flag is only honored when the request comes from a fully authenticated operator.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.