OpenClaw Tool Policy Bypass Vulnerability

Executive Summary

CVE-2026-44998 is a vulnerability in OpenClaw versions before 2026.4.20 where bundled MCP (Model Context Protocol) and LSP (Language Server Protocol) tools can bypass configured tool restrictions. Attackers with local agent access can append restricted tools to the effective tool set after policy filtering, effectively circumventing profile policies, allow/deny lists, owner-only restrictions, sandbox policies, and subagent policies.

This happens because bundled tools were not properly filtered through the final tool policy pipeline, allowing them to bypass security controls that normally restrict tool usage. The vulnerability is a local policy-enforcement bypass, not a remote compromise.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with local access to the OpenClaw agent to execute restricted tools that should have been blocked by security policies. This means unauthorized tools can be run despite configured restrictions such as owner-only access, sandboxing, and allow/deny lists.

As a result, it can lead to unauthorized access to sensitive tools and potentially sensitive data or operations that those tools control, increasing the risk of privilege escalation or misuse of the system.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves verifying whether bundled MCP and LSP tools are bypassing configured tool restrictions in OpenClaw versions before 2026.4.20.

Since the vulnerability requires local agent access and involves policy bypass after filtering, detection can focus on checking the effective tool set for the presence of restricted bundled tools that should have been blocked by policies.

Specific commands are not provided in the available resources, but general approaches include:

• Listing the active tools and their policies on the OpenClaw agent to identify if restricted bundled MCP or LSP tools are present.
• Reviewing logs for warnings or unusual tool executions that bypass policy restrictions.
• Using OpenClaw's diagnostic or debugging commands to inspect the tool policy filtering pipeline and effective tool sets.

Because no explicit detection commands are documented in the provided resources, users should consult OpenClaw documentation or support for specific commands to audit tool policies and effective tool sets.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade OpenClaw to version 2026.4.20 or later, where the vulnerability has been fixed.

The fix ensures that bundled MCP and LSP tools are properly filtered through the final tool policy pipeline, enforcing all configured restrictions including allow/deny lists, owner-only restrictions, sandbox policies, and subagent policies.

Until the upgrade can be applied, restrict local agent access to trusted users only, as the vulnerability requires local agent access to exploit.

Review and tighten tool policies and access controls to minimize the risk of unauthorized tool execution.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in OpenClaw allows bundled MCP and LSP tools to bypass configured tool restrictions, including owner-only restrictions and sandbox policies. This could potentially lead to unauthorized access to sensitive tools by attackers with local agent access.

Such unauthorized access could undermine the enforcement of security policies designed to protect sensitive data and system integrity, which are critical for compliance with standards like GDPR and HIPAA that require strict access controls and data protection measures.

However, the vulnerability is a local policy-enforcement bypass and does not represent a remote compromise. The severity is rated as moderate, and the issue was fixed in version 2026.4.20 by ensuring bundled tools are subject to the same policy checks as core tools.

Therefore, if left unpatched, this vulnerability could increase the risk of non-compliance with regulations that mandate strict access control and auditability, by allowing unauthorized tool execution that might lead to data exposure or policy violations.

Useful 0 Not Useful 0