CVE-2026-44997

Katalog CVE

CVSS 4.3 · Medium EPSS 0,38%

Kerentanan Incorrect Privilege Assignment pada openclaw. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to inherit depth, child-count limits, control scope, or target-agent restrictions. Attackers can exploit this by spawning child sessions that bypass subagent-only constraints, potentially escalating privileges or accessing restricted resources.

Rincian

Terbit di NVD

11 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/commit/31160dc069b7cc5d833b39c53736a41ad3befda2 patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-q3jj-46pq-826r patch · advisory pihak ketiga
• https://www.vulncheck.com/advisories/openclaw-security-envelope-constraint-bypass-in-acp-child-sessions patch · advisory pihak ketiga