GHSA-p7gr-f84w-hqg5
OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
A sandboxed session could use cross-agent `sessions_spawn` to create a child under an agent configured with `sandbox.mode="off"`, downgrading runtime confinement.
### Impact
In mixed-agent setups that allow cross-agent spawning, a sandboxed requester could escape into an unsandboxed child runtime.
### Fix
Spawn-time sandbox inheritance is now enforced: if the requester is sandboxed and the resolved child runtime would be unsandboxed, spawn is rejected.
### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
References
External links from the advisory. They lead to third-party sites.