OpenClaw before version 2026.4.20 contains a vulnerability that allows an attacker with local agent access to append restricted tools to the effective tool set after policy filtering, thereby bypassing configured tool restrictions. The flaw enables bypass of profile policies, allow/deny lists, owner‑only restrictions, sandbox policies, and subagent policies, potentially permitting unauthorized execution of tools that the system is meant to restrict.

The affected product is OpenClaw, all releases prior to 2026.4.20. No specific version list is provided beyond the release threshold, but any instance running an earlier build is susceptible.

The CVSS score is 2.3, reflecting a low severity vulnerability. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local agent access, so the attack vector is likely limited to environments where attackers can gain such foothold. Given the scope is confined to local manipulation of tool policies, the overall risk is relatively low, but it could undermine security controls that rely on tool restriction enforcement.