Listen to this Post
How the mentioned CVE works
The vulnerability resides in OpenClaw’s subagent control mechanism. In versions prior to 2026.3.22, leaf subagents—agents that are children of a parent subagent—could still invoke the `send` action to message controlled child sessions even when their own `controlScope` was set to a value narrower than “children”. The core issue was that the `send` action path did not fully propagate the controller’s context, allowing a subagent with insufficient scope to bypass intended restrictions.
Specifically, the command handler in `src/auto-reply/reply/commands-subagents/action-send.ts` failed to verify the requester’s ownership and scope against the target session. As a result, a leaf subagent could send messages to sessions it should not have been able to control, breaking the hierarchical privilege model.
The fix involved two key code changes:
1. `action-send.ts` now threads the controller context throughout the send path, ensuring that the requester’s identity and scope are carried forward.
2. `subagent-control.ts` was updated to block any `send` attempt unless the requester explicitly owns the target subagent and has `controlScope` set to "children".
These corrections enforce that only subagents with the appropriate scope can message their descendants, closing the bypass. The issue was reported by @space08 and fixed in commit 7679eb375294941b02214c234aff3948796969d0.
dailycve form
Platform: npm openclaw
Version: <2026.3.22
Vulnerability: controlScope bypass
Severity: Medium
date: 2026-03-22
Prediction: Already patched 2026-03-22
What Undercode Say:
Check installed openclaw version npm list openclaw Update to patched version (>=2026.3.22) npm install openclaw@latest Verify fixed files grep -r "controlScope" node_modules/openclaw/dist/agents/subagent-control.js
Exploit
A malicious leaf subagent with `controlScope` set to `”self”` or `”none”` could still invoke the `send` action targeting any child session of its parent, effectively bypassing scope limitations. By crafting a `send` command to a child it should not control, the attacker could impersonate the parent or inject messages into privileged conversations.
Protection from this CVE
Upgrade OpenClaw to version 2026.3.22 or later (latest recommended: 2026.3.23-2). No configuration changes are required; the fix is applied at the code level. If running a self-hosted instance, ensure the npm package is updated and the service is restarted.
Impact
Unauthorized subagents could send messages to controlled child sessions, breaking the intended isolation between subagent hierarchies. This could lead to privilege escalation, information disclosure, or unauthorized command execution within the chat environment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
