OpenClaw Vulnerability: Sandboxed ACP Spawn Requests Lead to Host Session Initialization
Summary
GHSA-9q36-67vc-rrwg: OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions. Affects openclaw versions < 2026.3.7. Fixed in 2026.3.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source framework designed for building chat applications with a focus on extensibility and security. It allows developers to create custom agents and commands within a sandboxed environment, ensuring that user interactions remain isolated from the host system. However, a recent vulnerability has been identified that allows sandboxed requester sessions to improperly initialize host-side ACP sessions, potentially compromising the security of the application.
Vulnerability Detail
The vulnerability arises from the handling of the '/acp spawn' command within OpenClaw. Although the framework initially blocked sandboxed sessions from executing certain commands, the '/acp spawn' command bypassed these restrictions, allowing unauthorized access to host-side ACP session initialization. This could lead to unauthorized actions being performed on the host system, especially if an attacker gains access to an already authorized sandboxed session. The technical flaw lies in the lack of a proper runtime policy guard before executing the initialization of ACP sessions, which could expose sensitive operations to potential exploitation.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.3.7
This is the first release that contains the fix.
npm install openclaw@2026.3.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as it becomes available.
Conclusion
The OpenClaw vulnerability allows unauthorized access to host-side ACP session initialization through sandboxed requests. It is essential to update to version 2026.3.7 or later to secure your application against this risk. Regular monitoring and updates are crucial for maintaining the security of your software.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows sandboxed requester sessions to improperly initialize host-side ACP sessions through the '/acp spawn' command, bypassing security restrictions.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of risk.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible to mitigate the risk.
The vulnerability was reported by a user identified as @tdjackey.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
