OpenClaw before 2026.4.22 contains a security envelope constraint bypass that allows a restricted subagent to spawn ACP child sessions without inheriting depth, child-count limits, control scope, or target-agent restrictions. Because the child sessions do not respect these constraints, an attacker who can control a subagent can use this flaw to bypass subagent-only limits, possibly escalating privileges or accessing resources that should be restricted. The likely attack vector is inferred from the description: an attacker with the ability to manipulate a restricted subagent may launch unauthorized child sessions, though the exact method is not explicitly detailed in the advisory.

Affected products are OpenClaw:OpenClaw. All versions prior to 2026.4.22 are vulnerable; no specific patch version is listed beyond that cutoff. The impact may apply to deployments that rely on subagent restrictions to enforce access controls.

The CVSS score of 2.3 indicates low severity, and the EPSS score is not provided. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to spawn ACP child sessions from a subagent with limited privileges; no remote code execution or high impact attack path has been identified. The likely risk is limited to the scope of subagents that can be compromised.