CVE-2026-27646: Openclaw Auth Bypass Vulnerability

CVE-2026-27646 Overview

CVE-2026-27646 is a sandbox escape vulnerability affecting OpenClaw versions prior to 2026.3.7. The vulnerability exists in the /acp spawn slash command, which allows authorized sandboxed sessions to improperly initialize host-side ACP (Agent Control Protocol) runtime. This authorization bypass enables attackers to cross from a sandboxed chat context into host-side ACP session initialization when ACP is enabled, effectively escaping the sandbox isolation boundary.

Critical Impact
Attackers with access to sandboxed sessions can bypass sandbox restrictions and gain access to host-side ACP runtime, potentially compromising the integrity of the host environment.

Affected Products

OpenClaw versions prior to 2026.3.7
OpenClaw for Node.js (all affected versions)

Discovery Timeline

2026-03-23 - CVE-2026-27646 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-27646

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization), representing a fundamental flaw in the access control mechanism of OpenClaw's ACP spawn functionality. The core issue lies in the application's failure to properly validate whether the requesting session is operating within a sandboxed context before allowing ACP session initialization.

When a user invokes the /acp spawn slash command from within a sandboxed chat session, the application should deny the request because ACP sessions run on the host outside the sandbox boundary. However, prior to the security patch, this authorization check was missing, allowing sandboxed sessions to initialize ACP runtime that executes with host-level privileges.

The impact of this vulnerability is significant for environments where sandbox isolation is a critical security control. Attackers who have already gained access to a sandboxed session can leverage this flaw to escape containment and interact with the host system through the ACP runtime interface.

Root Cause

The root cause is a missing authorization check in the ACP spawn command handler. The code path responsible for handling /acp spawn requests did not verify whether the requesting session was sandboxed before proceeding with ACP session initialization. Since ACP sessions operate on the host outside the sandbox boundary, this omission creates a privilege escalation vector.

Attack Vector

The attack requires local access and involves the following exploitation flow:

Attacker gains access to an authorized sandboxed session in OpenClaw
Attacker invokes the /acp spawn slash-command from within the sandboxed chat context
Due to missing authorization checks, the request bypasses sandbox restrictions
ACP runtime is initialized on the host-side, giving the attacker access outside the sandbox boundary

The security patch introduces the resolveAcpSpawnRuntimePolicyError function to enforce proper authorization:

typescript

export function resolveAcpSpawnRuntimePolicyError(params: {
  cfg: OpenClawConfig;
  requesterSessionKey?: string;
  requesterSandboxed?: boolean;
  sandbox?: SpawnAcpSandboxMode;
}): string | undefined {
  const sandboxMode = params.sandbox === "require" ? "require" : "inherit";
  const requesterRuntime = resolveSandboxRuntimeStatus({
    cfg: params.cfg,
    sessionKey: params.requesterSessionKey,
  });
  const requesterSandboxed = params.requesterSandboxed === true || requesterRuntime.sandboxed;
  if (requesterSandboxed) {
    return 'Sandboxed sessions cannot spawn ACP sessions because runtime="acp" runs on the host. Use runtime="subagent" from sandboxed sessions.';
  }
  if (sandboxMode === "require") {
    return 'sessions_spawn sandbox="require" is unsupported for runtime="acp" because ACP sessions run outside the sandbox. Use runtime="subagent" or sandbox="inherit".';
  }
  return undefined;
}

Source: GitHub Commit Update

Detection Methods for CVE-2026-27646

Indicators of Compromise

Unexpected ACP session initialization events originating from sandboxed session contexts
Log entries showing /acp spawn commands executed from sessions marked as sandboxed
Anomalous host-side process activity following sandboxed chat interactions
Unusual thread bindings between sandboxed sessions and ACP runtime

Detection Strategies

Monitor application logs for /acp spawn command invocations and correlate with session sandbox status
Implement alerting for any ACP session initialization attempts from sessions that should be isolated
Review audit trails for sandbox boundary violations in OpenClaw deployments
Deploy runtime monitoring to detect unauthorized transitions from sandboxed to host contexts

Monitoring Recommendations

Enable detailed logging for all ACP-related command executions in OpenClaw
Configure alerts for sandbox escape patterns, particularly commands that initialize host-side runtimes
Implement session context tracking to identify privilege boundary crossings
Regularly audit ACP configuration to ensure proper sandbox enforcement policies

How to Mitigate CVE-2026-27646

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.7 or later immediately
Review existing sandboxed sessions for any evidence of exploitation
Audit ACP configuration settings and disable ACP if not required
Implement additional monitoring for sandbox escape attempts until patching is complete

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.7. The patch introduces the resolveAcpSpawnRuntimePolicyError function in src/agents/acp-spawn.ts which explicitly checks whether the requesting session is sandboxed before allowing ACP session initialization. The fix ensures sandboxed sessions receive an error message directing them to use runtime="subagent" instead of ACP spawn.

For detailed patch information, see the GitHub Security Advisory GHSA-9q36-67vc-rrwg and the GitHub Commit Update.

Workarounds

Disable ACP functionality entirely if it is not required for your deployment
Restrict access to sandboxed sessions to only trusted users until the patch can be applied
Implement network-level isolation to limit the impact of potential sandbox escapes
Use runtime="subagent" instead of ACP spawn for sandboxed session workflows

bash

# Configuration example - disable ACP to mitigate risk
# In your OpenClaw configuration file:
export OPENCLAW_ACP_ENABLED=false

# Or in config.json:
# { "acp": { "enabled": false } }