# GHSA-w5c7-9qqw-6645: OpenClaw inter-session prompts could be treated as direct user instructions

> Attackers can inject instructions into other sessions via inter-session messages, bypassing trust boundaries and triggering unintended privileged actions.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 18 Feb 2026

## What is GHSA-w5c7-9qqw-6645?

GHSA-w5c7-9qqw-6645 is a vulnerability in openclaw, published on 18 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

## Summary

Inter-session messages sent via `sessions_send` could be interpreted as direct end-user instructions because they were persisted as `role: "user"` without provenance metadata.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.12` (i.e. `< 2026.2.13`)
- Fixed in: `2026.2.13` (patched versions `>= 2026.2.13`)

## Impact

A delegated or internal session could inject instructions into another session that appeared equivalent to externally-originated user input.

This is an instruction-provenance confusion issue (confused-deputy style), which can lead to unintended privileged behavior in workflows that trust `role: "user"` as a sole authority signal.

## Technical details

Before the fix, routed inter-session prompts were stored as regular user turns without a verifiable source marker.

As a result, downstream workers and transcript readers could not distinguish:
- External user input
- Internal inter-session routed input

## Fix

OpenClaw now carries explicit input provenance end-to-end for routed prompts.

Key changes:
- Added structured provenance model (`inputProvenance`) with `kind` values including `inter_session`.
- `sessions_send` and agent-to-agent steps now set inter-session provenance when invoking target runs.
- Provenance is persisted on user messages as `message.provenance.kind = "inter_session"` (role remains `user` for provider compatibility).
- Transcript readers and memory helpers were updated to respect provenance and avoid treating inter-session prompts as external user-originated input.
- Runtime context rebuilding now annotates inter-session turns with an explicit in-memory marker (`[Inter-session message]`) for clearer model-side disambiguation.
- Regression tests were added for transcript parsing, session tools flow, runner sanitization, and memory hook behavior.

## Fix Commit(s)

- `85409e401b6586f83954cb53552395d7aab04797`

## Workarounds

If immediate upgrade is not possible:
- Disable or restrict `sessions_send` in affected environments.
- Do not use role alone as an authority boundary; require provenance-aware checks in orchestration logic.

## Credit

Reported by @anbecker.

Thanks @anbecker for reporting.

## Which versions are affected by GHSA-w5c7-9qqw-6645?

2 open source packages ship an affected version, including openclaw.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `openclaw` | npm | All versions | 2026.2.13 |
| `openclaw` | npm | All versions | 2026.2.13 |

## How do I fix GHSA-w5c7-9qqw-6645?

Upgrade openclaw to 2026.2.13 or later.

## Is GHSA-w5c7-9qqw-6645 being exploited?

There is no known exploitation of GHSA-w5c7-9qqw-6645 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-w5c7-9qqw-6645 and fix it if it is affected.

What it is: GHSA-w5c7-9qqw-6645 is a vulnerability in openclaw, published on 18 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-w5c7-9qqw-6645 in the wild and no public exploit code.

Affected packages and fixed versions:
- openclaw (npm): affected all versions; fixed in 2026.2.13
- openclaw (npm): affected all versions; fixed in 2026.2.13

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-w5c7-9qqw-6645/ (Markdown: https://insights.sbomify.com/GHSA-w5c7-9qqw-6645/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-w5c7-9qqw-6645

---
From sbomify Insights: https://insights.sbomify.com/GHSA-w5c7-9qqw-6645/
Summaries are generated and may contain mistakes; the official description above is the record.