CVE-2026-100552: OpenClaw before 2026.8.1 Policy Bypass via Native Tools
OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a lower-trust conversation was assigned to a Codex runtime and restricted with a per-chat tool allowlist, a participant able to trigger that agent could still reach native command and file tools, bypassing the configured allowlist. The practical impact depends on the runtime's host permissions and sandbox configuration. The issue is fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments before 2026.8.1 are exposed when a lower-trust conversation is assigned to a Codex runtime and relies on a conversation-level tools.allow policy to restrict available tools. The policy bypass specifically affects Codex app-server runtime tools.
What access does an attacker need to exploit it?
An attacker must be able to trigger the agent in the affected conversation. No additional user interaction is required, but the vulnerable conversation must use a Codex runtime with a per-chat tool allowlist.
What capabilities could be reached despite the allowlist?
A participant may be able to reach native shell, process, file, and patch tools owned by the Codex runtime even when those tools are not permitted by the conversation-level allowlist. The resulting impact depends on the host permissions and sandbox configuration of that runtime.
How can I determine whether a conversation is affected?
Check whether OpenClaw is older than 2026.8.1, whether the conversation is assigned to a Codex runtime, and whether its security boundary depends on a per-chat tools.allow restriction. If all apply, the configured allowlist did not restrict the Codex native tools.
What is the available remediation?
Update OpenClaw to version 2026.8.1, which fixes the issue. Until then, do not treat conversation-level tool allowlists as effective restrictions for Codex runtime native tools, and account for the runtime's host permissions and sandbox configuration.