Skip to content
AI Sec Watch
HighVulnerability

GHSA-943q-mwmv-hhvh: OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-943q-mwmv-hhvh
Published
Record updated
View JSON
Affected
  • openclaw < 2026.2.14
Fixed in
2026.2.14
  • released February 14, 2026, 15 days before disclosure

Summary

OpenClaw Gateway's authenticated POST /tools/invoke endpoint did not deny high-risk session orchestration tools such as sessions_spawn and sessions_send by default, so a caller holding a valid Gateway token could create or control agent sessions and inject messages across sessions. ACP clients could also auto-approve permission requests for risky tools with insufficient user interaction. The advisory rates it CVSS 8.8 and affects openclaw versions before 2026.2.14.

Mitigation

Fixed in openclaw >= 2026.2.14. The default now denies high-risk tools over HTTP /tools/invoke (overridable with gateway.tools.{allow,deny}), ACP clients prompt for any non-read/search permission request, and ACP safe-kind inference is stricter. Deployment guidance: keep the Gateway loopback-only (gateway.bind="loopback" or openclaw gateway run --bind loopback), avoid direct public internet exposure and use an SSH tunnel or Tailscale instead, and audit any configuration that opts into default-denied HTTP tools via gateway.tools.allow.

Related items