CVE-2026-44997

OpenClaw before 2026.4.22 is affected by a security envelope constraint bypass in ACP child sessions. The vulnerability allows restricted subagents to spawn ACP child sessions that do not inherit depth, child-count limits, control scope, or target-agent restrictions, potentially enabling privileg...