CVE-2026-44998: Openclaw Auth Bypass Vulnerability

CVE-2026-44998 Overview

CVE-2026-44998 is an authorization bypass vulnerability [CWE-863] in OpenClaw versions before 2026.4.20. The flaw allows bundled Model Context Protocol (MCP) and Language Server Protocol (LSP) tools to circumvent configured tool restrictions inside the agent runtime. Attackers with local agent access can append restricted tools to the effective tool set after policy filtering executes. This bypass defeats profile policies, allow and deny lists, owner-only restrictions, sandbox policies, and subagent policies. The vendor addressed the issue by routing bundled tools through a final policy filter in the embedded runner.

Critical Impact
Authenticated local users can bypass tool execution policies in OpenClaw agents, expanding the effective tool set beyond administrator-defined restrictions.

Affected Products

OpenClaw versions prior to 2026.4.20
OpenClaw distributions packaged for Node.js runtimes
Embedded agent runners using the pi-embedded-runner component

Discovery Timeline

2026-05-11 - CVE-2026-44998 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44998

Vulnerability Analysis

The vulnerability resides in the OpenClaw agent embedded runner, specifically in how bundled tools are merged with the agent's effective tool set. OpenClaw applies policy filtering — including profile policies, allow and deny lists, owner-only restrictions, sandbox policies, and subagent policies — to determine which tools an agent may invoke. However, bundled MCP and LSP tools were appended to the effective tool set after this policy filtering step. The result is that any tool delivered through the bundled MCP or LSP pipeline becomes invokable regardless of administrator-defined restrictions. An attacker who can influence the bundled tool set, or who controls a local agent context, can reintroduce previously restricted tools into the agent runtime.

Root Cause

The root cause is an ordering defect in authorization enforcement [CWE-863]. The runner constructed the final effective tool list by concatenating bundled tools after policy filtering instead of subjecting them to the same policy gate. The fix introduces a helper, applyFinalEffectiveToolPolicy, that re-applies policy enforcement to the merged tool set as the last step before tool execution.

Attack Vector

Exploitation requires local access to the agent runtime and the ability to invoke or influence bundled MCP or LSP tools. Once invoked, the bundled tool path bypasses configured restrictions, enabling the attacker to call tools that profile or sandbox policies would otherwise deny. The impact is limited to confidentiality and integrity within the agent's tool execution surface.

typescript

// Source: https://github.com/openclaw/openclaw/commit/0e7a992d3f3155199c1acc2dd9a53c5b3a4d3ada
// Patch in src/agents/pi-embedded-runner/compact.ts
   compactWithSafetyTimeout,
   resolveCompactionTimeoutMs,
 } from "./compaction-safety-timeout.js";
+import { applyFinalEffectiveToolPolicy } from "./effective-tool-policy.js";
 import { buildEmbeddedExtensionFactories } from "./extensions.js";
 import { applyExtraParamsToAgent } from "./extra-params.js";
 import { getDmHistoryLimitFromSessionKey, limitHistoryTurns } from "./history.js";

typescript

// Source: https://github.com/openclaw/openclaw/commit/0e7a992d3f3155199c1acc2dd9a53c5b3a4d3ada
// Patch in src/agents/pi-embedded-runner/run/attempt.ts
 import { isCacheTtlEligibleProvider, readLastCacheTtlTimestamp } from "../cache-ttl.js";
 import { resolveCompactionTimeoutMs } from "../compaction-safety-timeout.js";
 import { runContextEngineMaintenance } from "../context-engine-maintenance.js";
+import { applyFinalEffectiveToolPolicy } from "../effective-tool-policy.js";
 import { buildEmbeddedExtensionFactories } from "../extensions.js";
 import { applyExtraParamsToAgent, resolveAgentTransportOverride } from "../extra-params.js";
 import { prepareGooglePromptCacheStreamFn } from "../google-prompt-cache.js";

Both patches import and invoke applyFinalEffectiveToolPolicy so that bundled tools pass through the same policy gate as the rest of the effective tool set.

Detection Methods for CVE-2026-44998

Indicators of Compromise

Invocation of MCP or LSP tools that are excluded by the active OpenClaw profile, allow list, or sandbox policy.
Agent log entries showing tool execution from bundled tool sources without corresponding policy authorization events.
Unexpected child processes or subagent invocations originating from pi-embedded-runner after a denied tool name.

Detection Strategies

Compare the configured tool policy against the actual effective tool set observed in runtime telemetry; any divergence indicates the bundled-tool bypass condition.
Audit OpenClaw agent telemetry for tool calls that should be blocked by owner-only, sandbox, or subagent policies.
Hash and inventory bundled MCP and LSP tools across deployments to identify unauthorized additions.

Monitoring Recommendations

Enable verbose policy-decision logging on OpenClaw agents and forward logs to a centralized analytics platform.
Alert on disabled, removed, or denied tools appearing in successful agent tool-invocation events.
Track OpenClaw version inventory and flag any host still running a release prior to 2026.4.20.

How to Mitigate CVE-2026-44998

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.20 or later on every host running an embedded agent runner.
Review and tighten profile, allow, deny, sandbox, and subagent policies to ensure least privilege after patching.
Audit which bundled MCP and LSP tools are loaded by agents and remove any that are unnecessary.

Patch Information

The vendor fix is published in commit 0e7a992d3f3155199c1acc2dd9a53c5b3a4d3ada, which adds applyFinalEffectiveToolPolicy to the embedded runner so bundled tools are filtered by the final policy. Details are available in the OpenClaw GitHub Commit, the GitHub Security Advisory GHSA-qrp5-gfw2-gxv4, and the VulnCheck Advisory: OpenClaw Tool Policy Bypass.

Workarounds

Restrict local access to the OpenClaw agent runtime to trusted operators only.
Disable or unbundle MCP and LSP tools that are not strictly required until the patch is applied.
Run OpenClaw agents under reduced operating-system privileges to limit the impact of tool-policy bypass.

bash

# Verify installed OpenClaw version and update via npm
npm ls openclaw
npm install openclaw@2026.4.20

# Confirm the patched policy module is present
node -e "require.resolve('openclaw/dist/agents/pi-embedded-runner/effective-tool-policy.js')"