CVE-2026-100552 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a lower-trust conversation was assigned to a Codex runtime and restricted with a per-chat tool allowlist, a participant able to trigger that agent could still reach native command and file tools, bypassing the configured allowlist. The practical impact depends on the runtime's host permissions and sandbox configuration. The issue is fixed in 2026.8.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in OpenClaw versions prior to 2026.8.1 represents a critical failure in access control enforcement within an AI agent orchestration framework, specifically affecting the integration with the Codex app-server runtime environment. This flaw stems from an incomplete implementation of per-chat tool policies, where the security boundary intended to restrict agent capabilities based on conversation trust levels was not fully applied across all available tools. The core technical issue lies in a logic error within the policy evaluation engine that processes allowlists for specific chat sessions. When a lower-trust conversation is assigned to a Codex runtime and subjected to strict per-chat tool restrictions, the system correctly filters out OpenClaw-native tools based on the configured allowlist. However, it fails to apply these same constraints to shell execution, process management, file system interaction, and code patching capabilities that are owned by the underlying Codex runtime rather than the OpenClaw wrapper layer. This architectural separation creates a bypass vector where security policies defined at the application level do not propagate effectively to the deeper infrastructure tools managed by the runtime environment.
From an operational perspective, this misconfiguration allows any participant with the ability to trigger or interact with the agent within that specific conversation context to execute commands and access files outside of the intended restrictions. The severity of the impact is directly proportional to the permissions granted to the Codex runtime on its host system. If the runtime operates with elevated privileges or broad file system access, an attacker could potentially achieve arbitrary command execution, read sensitive configuration files, exfiltrate data, or modify source code repositories under the guise of legitimate agent operations. This scenario aligns closely with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if such credentials are leveraged through shell access, though primarily it is a classic case of privilege escalation via broken access control mechanisms. The vulnerability effectively undermines the principle of least privilege by allowing low-trust inputs to invoke high-privilege system functions without adequate verification or restriction.
This flaw also maps directly to MITRE ATT&CK techniques related to Command and Scripting Interpreter execution, specifically T1059, as well as potential file access patterns associated with Data Collection via File and Directory Discovery under T1083 if the shell tools are used to enumerate system contents. The bypass of security controls allows an adversary to move laterally within a compromised environment or escalate privileges by leveraging trusted application binaries that were not properly sandboxed against untrusted inputs. In environments where AI agents interact with external systems, such as development pipelines or infrastructure management platforms, this vulnerability could lead to significant compromise of the host machine and connected services. The lack of consistent policy enforcement across different tool categories creates a blind spot in security monitoring and control implementation, making it difficult for defenders to detect unauthorized activities that appear legitimate because they originate from trusted runtime components.
The recommended mitigation is straightforward but requires immediate action: organizations running OpenClaw must upgrade the npm package openclaw to version 2026.8.1 or later as soon as possible. This release addresses the logic error in the policy enforcement layer, ensuring that per-chat tool allowlists are correctly applied to all tools provided by both the OpenClaw framework and the underlying Codex runtime. Until the upgrade is performed, administrators should consider implementing network-level restrictions on the host running the agent, such as firewall rules limiting outbound connections or using operating system-level sandboxing like SELinux or AppArmor to restrict what shell commands can be executed regardless of application-layer policies. Additionally, reviewing existing conversation configurations for low-trust users and restricting their access to agents that utilize Codex runtimes is advised until the patch is deployed. Regular audits of tool permissions and runtime capabilities should also be conducted to ensure future updates do not introduce similar discrepancies between different layers of the agent architecture.