N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-w5c7-9qqw-6645

GHSA-w5c7-9qqw-6645: OpenClaw inter-session prompts could be treated as direct user instructions

Summary

Inter-session messages sent via sessions_send could be interpreted as direct end-user instructions because they were persisted as role: "user" without provenance metadata.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.12 (i.e. < 2026.2.13)
Fixed in: 2026.2.13 (patched versions >= 2026.2.13)

Impact

A delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input.

This is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in workflows that trust role: "user" as a sole authority signal.

Technical details

Before the fix, routed inter-session prompts were stored as regular user turns without a verifiable source marker.

As a result, downstream workers and transcript readers could not distinguish:

External user input
Internal inter-session routed input

Fix

OpenClaw now carries explicit input provenance end-to-end for routed prompts.

Key changes:

Added structured provenance model (inputProvenance) with kind values including inter_session.
sessions_send and agent-to-agent steps now set inter-session provenance when invoking target runs.
Provenance is persisted on user messages as message.provenance.kind = "inter_session" (role remains user for provider compatibility).
Transcript readers and memory helpers were updated to respect provenance and avoid treating inter-session prompts as external user-originated input.
Runtime context rebuilding now annotates inter-session turns with an explicit in-memory marker ([Inter-session message]) for clearer model-side disambiguation.
Regression tests were added for transcript parsing, session tools flow, runner sanitization, and memory hook behavior.

Fix Commit(s)

85409e401b6586f83954cb53552395d7aab04797

Workarounds

If immediate upgrade is not possible:

Disable or restrict sessions_send in affected environments.
Do not use role alone as an authority boundary; require provenance-aware checks in orchestration logic.

Credit

Reported by @anbecker.

Thanks @anbecker for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-w5c7-9qqw-6645

GHSA-w5c7-9qqw-6645:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.13	2026.2.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-w5c7-9qqw-6645, is a confused deputy issue in the openclaw package where inter-session messages could be misinterpreted as direct instructions from an end-user. This was because messages sent between agents using the sessions_send tool were persisted with role: "user" but lacked any provenance metadata to indicate their internal origin.

The analysis of the patch commit 85409e401b6586f83954cb53552395d7aab04797 reveals that the fix involves adding and propagating an inputProvenance object throughout the message lifecycle. My analysis identified four key functions involved in this vulnerability:

createSessionsSendTool: This is the origin of the vulnerability. It creates the inter-session message but previously failed to attach any provenance data.
runSessionsSendA2AFlow: This function manages complex agent-to-agent interactions and was vulnerable because it did not preserve provenance across multiple communication steps.
installSessionToolResultGuard: This function is where the untrusted data was persisted. It was modified to intercept messages and apply the provenance information before writing them to the session transcript.
sanitizeSessionHistory: This function consumes the persisted data to prepare context for the language model. It was vulnerable because it didn't differentiate between internal and external user messages, potentially leading the model to act on unintended instructions. The patch ensures these messages are now clearly annotated.

By failing to track the origin of instructions, the system created a trust boundary violation where an internal agent could impersonate an external user, leading to unintended and potentially privileged behavior. The fix correctly implements provenance tracking at the point of creation, persistence, and consumption, mitigating the confused deputy problem.

Vulnerable functions

createSessionsSendTool

src/agents/tools/sessions-send-tool.ts

This function creates the `sessions_send` tool, which is used to send messages between different agent sessions. The vulnerability lies in the fact that, before the patch, this function did not attach any provenance information to the messages it created. As a result, a message sent from one agent to another was persisted with `role: "user"` but without any metadata to distinguish it from a message originating directly from an external end-user. This could cause the receiving agent to trust and execute the instructions in the message as if they came from the user, leading to a confused deputy vulnerability.

installSessionToolResultGuard

src/agents/session-tool-result-guard.ts

This function intercepts messages before they are persisted to the session's transcript file. The vulnerability was that it would append user messages directly to the transcript without adding the necessary provenance metadata. An inter-session message, which has `role: "user"`, would be indistinguishable from an external user's message in the stored transcript. The patch introduces a `transformMessageForPersistence` step, which is used to apply the `inputProvenance` to the message before it is written, ensuring that internally-routed messages are correctly marked.

sanitizeSessionHistory

src/agents/pi-embedded-runner/google.ts

This function prepares the conversation history before sending it to the language model for processing. The vulnerability was that it treated all messages with `role: "user"` identically, failing to distinguish between genuine user input and inter-session messages. This could lead to the model interpreting an internal, automated instruction as a command from the end-user, potentially causing unintended actions. The patch fixes this by calling `annotateInterSessionUserMessages`, which adds a `[Inter-session message]` prefix to the content of internal messages, making their origin clear to the model.

runSessionsSendA2AFlow

src/agents/tools/sessions-send-tool.a2a.ts

This function orchestrates the agent-to-agent (A2A) communication flow, which can involve multiple back-and-forth replies. The vulnerability existed because the provenance of messages was not maintained throughout this multi-step conversation. A reply from a target agent could be misinterpreted as a new, user-initiated instruction in the context of the requesting agent. The patch ensures that provenance details (`sourceSessionKey`, `sourceChannel`, `sourceTool`) are propagated through each step of the A2A flow.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-w5c7-9qqw-6645: OpenClaw inter-session prompts could be treated as direct user instructions

Summary

Affected Packages / Versions

Impact

Technical details

Fix

Fix Commit(s)

Workarounds

Credit

GHSA-w5c7-9qqw-6645:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-w5c7-9qqw-6645: OpenClaw inter-session prompts could be treated as direct user instructions

Summary

Affected Packages / Versions

Impact

Technical details

Fix

Fix Commit(s)

Workarounds

Credit

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI