{"id":"GHSA-w5c7-9qqw-6645","aliases":[],"url":"https://o3.security/vulnerability/GHSA-w5c7-9qqw-6645","summary":"OpenClaw inter-session prompts could be treated as direct user instructions","details":"## Summary\n\nInter-session messages sent via `sessions_send` could be interpreted as direct end-user instructions because they were persisted as `role: \"user\"` without provenance metadata.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.2.12` (i.e. `< 2026.2.13`)\n- Fixed in: `2026.2.13` (patched versions `>= 2026.2.13`)\n\n## Impact\n\nA delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input.\n\nThis is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in workflows that trust `role: \"user\"` as a sole authority signal.\n\n## Technical details\n\nBefore the fix, routed inter-session prompts were stored as regular user turns without a verifiable source marker.\n\nAs a result, downstream workers and transcript readers could not distinguish:\n- External user input\n- Internal inter-session routed input\n\n## Fix\n\nOpenClaw now carries explicit input provenance end-to-end for routed prompts.\n\nKey changes:\n- Added structured provenance model (`inputProvenance`) with `kind` values including `inter_session`.\n- `sessions_send` and agent-to-agent steps now set inter-session provenance when invoking target runs.\n- Provenance is persisted on user messages as `message.provenance.kind = \"inter_session\"` (role remains `user` for provider compatibility).\n- Transcript readers and memory helpers were updated to respect provenance and avoid treating inter-session prompts as external user-originated input.\n- Runtime context rebuilding now annotates inter-session turns with an explicit in-memory marker (`[Inter-session message]`) for clearer model-side disambiguation.\n- Regression tests were added for transcript parsing, session tools flow, runner sanitization, and memory hook behavior.\n\n## Fix Commit(s)\n\n- `85409e401b6586f83954cb53552395d7aab04797`\n\n## Workarounds\n\nIf immediate upgrade is not possible:\n- Disable or restrict `sessions_send` in affected environments.\n- Do not use role alone as an authority boundary; require provenance-aware checks in orchestration logic.\n\n## Credit\n\nReported by @anbecker.\n\nThanks @anbecker for reporting.","published":"2026-02-18T00:56:51Z","modified":"2026-02-18T01:44:52.415375Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":"2026.2.13"}],"fix":{"url":"https://github.com/openclaw/openclaw/commit/85409e401b6586f83954cb53552395d7aab04797","label":"openclaw/openclaw@85409e4"},"references":[{"type":"WEB","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w5c7-9qqw-6645"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/commit/85409e401b6586f83954cb53552395d7aab04797"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"},{"type":"WEB","url":"https://github.com/openclaw/openclaw/releases/tag/v2026.2.12"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-18T01:44:52.415375Z"}}