T05 · Unauthorized Access and Privilege Escalation
- Location
docs/reproduction.md:26- Finding
Gateway-Wide Blanket Approval Policy for Unattended Coding Agents
- Content
View full analysis
Vulnerability Details
File Location:
docs/reproduction.md, lines 26-39
Vulnerability Type: Excessive agent permissions and violation of least privilege
Risk Level: MediumVulnerable Configuration:
json { "plugins": { "entries": { "acpx": { "enabled": true, "config": { "permissionMode": "approve-all", "nonInteractivePermissions": "deny" } } } } }Technical Analysis
The setup guide recommends configuring the gateway-side ACPX plugin with
permissionMode: "approve-all". This is a broad permission policy applied at the plugin level rather than a task-scoped grant limited to a worker's assigned repository, worktree, commands, and artifact directories.The package also instructs the orchestrator to read a handoff Markdown file and pass it directly to
sessions_spawnas the worker's task prompt. Persistent ACP workers then perform coding operations based on that file and repository context. Consequently, attacker-controlled content in a task specification, handoff, repository instruction file, or other worker-readable project file may influence a broadly authorized coding agent.The accompanying
nonInteractivePermissions: "deny"setting may provide partial protection, but the package does not define its precedence or effective interaction withpermissionMode: "approve-all". It therefore does not establish that unattended agents are consistently denied excessive operations. The blanket approval recommendation violates least-privilege principles even if some noninteractive requests are ultimately blocked.Attack Path
- An attacker introduces malicious instructions into a repository file, task specification, shared handoff, or other content that an ACP worker is directed to read.
- The OpenClaw orchestrator reads the referenced handoff and supplies it to
sessions_spawnas the worker prompt. - A pers ...[truncated 1782 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace
permissionMode: "approve-all"with deny-by-default, task-scoped authorization. - Restrict each worker to its assigned repository or Git worktree and explicitly designated artifact directories.
- Allowlist only the commands required for the current task; deny arbitrary shell execution and access to service-management commands.
- Run ACP workers under a dedicated, unprivileged operating-system identity with no access to unrelated repositories, home-directory secrets, SSH material, or gateway configuration.
- Isolate credentials from worker processes. Use narrowly scoped, short-lived credentials and separate service identities for different ACP backends.
- Treat handoffs, repository instructions, issue descriptions, and generated context as untrusted input. Delimit them clearly and validate them before incorporating them into worker prompts.
- Add explicit controls preventing worker instructions from expanding filesystem scope or changing permission policy.
- Document and test the precedence between
permissionModeandnonInteractivePermissions, including negative tests proving that unattended workers cannot obtain out-of-scope access. - Prefer ephemeral workers where persistence is unnecessary, and terminate sessions when their assigned workstream is complete.
- Record permission requests and worker actions in an audit log so anomalous access can be detected and investigated.
- Replace