CVE-2026-44997: Openclaw

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to inherit depth, child-count limits, control scope, or target-agent restrictions. Attackers can exploit this by spawning child sessions that bypass subagent-only constraints, potentially escalating privileges or accessing restricted resources.

Affected products

• Openclaw Openclaw: before 2026.4.22 (fixed in 2026.4.22)

Published 2026-05-11. Last modified 2026-06-17.