BREW-OPENCLAW-CLI-GHSA-W… (GHSA-W5C7-9QQW-6645)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:21 – Updated: 2026-09-20 10:38 – Source website
VLAI
Summary
OpenClaw inter-session prompts could be treated as direct user instructions
Details

Summary

Inter-session messages sent via sessions_send could be interpreted as direct end-user instructions because they were persisted as role: "user" without provenance metadata.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected versions: <= 2026.2.12 (i.e. < 2026.2.13)
  • Fixed in: 2026.2.13 (patched versions >= 2026.2.13)

Impact

A delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input.

This is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in workflows that trust role: "user" as a sole authority signal.

Technical details

Before the fix, routed inter-session prompts were stored as regular user turns without a verifiable source marker.

As a result, downstream workers and transcript readers could not distinguish: - External user input - Internal inter-session routed input

Fix

OpenClaw now carries explicit input provenance end-to-end for routed prompts.

Key changes: - Added structured provenance model (inputProvenance) with kind values including inter_session. - sessions_send and agent-to-agent steps now set inter-session provenance when invoking target runs. - Provenance is persisted on user messages as message.provenance.kind = "inter_session" (role remains user for provider compatibility). - Transcript readers and memory helpers were updated to respect provenance and avoid treating inter-session prompts as external user-originated input. - Runtime context rebuilding now annotates inter-session turns with an explicit in-memory marker ([Inter-session message]) for clearer model-side disambiguation. - Regression tests were added for transcript parsing, session tools flow, runner sanitization, and memory hook behavior.

Fix Commit(s)

  • 85409e401b6586f83954cb53552395d7aab04797

Workarounds

If immediate upgrade is not possible: - Disable or restrict sessions_send in affected environments. - Do not use role alone as an authority boundary; require provenance-aware checks in orchestration logic.

Credit

Reported by @anbecker.

Thanks @anbecker for reporting.

Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "2026.2.13"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "openclaw-cli",
        "purl": "pkg:brew/openclaw-cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.1.29"
            },
            {
              "fixed": "2026.2.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/openclaw@2026.9.5",
        "name": "openclaw",
        "strategy": "registry",
        "subject_version": "2026.9.5"
      }
    ]
  },
  "details": "## Summary\n\nInter-session messages sent via `sessions_send` could be interpreted as direct end-user instructions because they were persisted as `role: \"user\"` without provenance metadata.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.12` (i.e. `\u003c 2026.2.13`)\n- Fixed in: `2026.2.13` (patched versions `\u003e= 2026.2.13`)\n\n## Impact\n\nA delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input.\n\nThis is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in workflows that trust `role: \"user\"` as a sole authority signal.\n\n## Technical details\n\nBefore the fix, routed inter-session prompts were stored as regular user turns without a verifiable source marker.\n\nAs a result, downstream workers and transcript readers could not distinguish:\n- External user input\n- Internal inter-session routed input\n\n## Fix\n\nOpenClaw now carries explicit input provenance end-to-end for routed prompts.\n\nKey changes:\n- Added structured provenance model (`inputProvenance`) with `kind` values including `inter_session`.\n- `sessions_send` and agent-to-agent steps now set inter-session provenance when invoking target runs.\n- Provenance is persisted on user messages as `message.provenance.kind = \"inter_session\"` (role remains `user` for provider compatibility).\n- Transcript readers and memory helpers were updated to respect provenance and avoid treating inter-session prompts as external user-originated input.\n- Runtime context rebuilding now annotates inter-session turns with an explicit in-memory marker (`[Inter-session message]`) for clearer model-side disambiguation.\n- Regression tests were added for transcript parsing, session tools flow, runner sanitization, and memory hook behavior.\n\n## Fix Commit(s)\n\n- `85409e401b6586f83954cb53552395d7aab04797`\n\n## Workarounds\n\nIf immediate upgrade is not possible:\n- Disable or restrict `sessions_send` in affected environments.\n- Do not use role alone as an authority boundary; require provenance-aware checks in orchestration logic.\n\n## Credit\n\nReported by @anbecker.\n\nThanks @anbecker for reporting.",
  "id": "BREW-openclaw-cli-GHSA-w5c7-9qqw-6645",
  "modified": "2026-09-20T10:38:33Z",
  "published": "2026-08-13T17:21:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-w5c7-9qqw-6645"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/85409e401b6586f83954cb53552395d7aab04797"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.12"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw inter-session prompts could be treated as direct user instructions",
  "upstream": [
    "GHSA-w5c7-9qqw-6645"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.