Openclaw cli: OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions (CVE-2026-27646)

The openclaw-cli package contained a security flaw (CVE-2026-27646) where sandboxed requester sessions could bypass intended restrictions and initialize host-side ACP sessions using the /acp spawn command. While direct ACP spawn requests were blocked for sandboxed sessions, the slash-command path did not apply this restriction, allowing an authorized sender in a sandboxed session to escalate privileges to the host ACP runtime if ACP was enabled and a backend was available. The fix introduced a shared ACP runtime-policy guard reused in the /acp spawn handler to reject sandboxed requests early, preventing unauthorized host ACP session initialization.

An attacker with access to a sandboxed session could escalate privileges by initializing host-side ACP sessions, potentially leading to unauthorized actions within the host ACP runtime. The CVSS score of 6.1 (medium severity) reflects limited attack vector (local), low complexity, and no user interaction required, with low confidentiality impact but high integrity impact and no availability impact.

A patch is available in openclaw-cli version 2026.3.7 and later. Users should upgrade to this version or newer to ensure the vulnerability is fixed. The fix enforces proper runtime-policy guards on the /acp spawn command to prevent sandboxed sessions from initializing host ACP sessions. No additional mitigation is required once patched.