T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/published-bootstrap-helper.md:107- Finding
Overly Broad Cross-Agent Permissions and Global Session Visibility
- Content
View full analysis
Vulnerability Details
File Location:
references/published-bootstrap-helper.md:107-125
Vulnerability Type: Excessive cross-agent authorization and session visibility
Risk Level: HighVulnerable Code
powershell if ((-not $hasAgentToAgent -or -not $hasEnabled -or -not $hasSessionsAll -or -not $hasAllow) -and $AutoFixConfig) { Write-Step "Config is incomplete. Applying bootstrap-safe config and restarting gateway..." $config = Get-Content $configPath -Raw | ConvertFrom-Json -Depth 100 if (-not $config.tools) { $config | Add-Member -NotePropertyName tools -NotePropertyValue ([pscustomobject]@{}) } if (-not $config.tools.agentToAgent) { $config.tools | Add-Member -NotePropertyName agentToAgent -NotePropertyValue ([pscustomobject]@{}) } $config.tools.agentToAgent.enabled = $true $config.tools.agentToAgent.allow = @("*") if (-not $config.tools.sessions) { $config.tools | Add-Member -NotePropertyName sessions -NotePropertyValue ([pscustomobject]@{}) } $config.tools.sessions.visibility = "all" $json = $config | ConvertTo-Json -Depth 100 Copy-Item $configPath "$configPath.bak" -Force Set-Content -Path $configPath -Value $json -Encoding UTF8 openclaw gateway restart | Out-Host }The same insecure bootstrap policy is explicitly recommended in
references/local-bootstrap.md:44-67:json { "tools": { "agentToAgent": { "enabled": true, "allow": ["*"] }, "sessions": { "visibility": "all" } } }Technical Analysis
The workflow needs cross-agent communication for only two named agents,
xiaomaandxiaoniu. However, the auto-fix helper replaces the authorization policy with the wildcardallow = @("*")and changes session visibility to"all".This violates least privilege in two ways:
- The wildcard authorization can permit agents unrelated to Workhorse Duo to participate in cross-agent communication.
- Global session visibility can expose sessions ...[truncated 1942 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the wildcard
agentToAgent.allowvalue with an explicit allowlist containing only the agents and communication directions required by the workflow. - Use the narrowest session visibility supported by OpenClaw instead of
"all". Prefer visibility limited to the current task, session tree, or explicitly selected worker sessions. - Preserve existing stricter policies. The helper should merge only the minimum required entries rather than overwrite the entire allow policy.
- Before writing the configuration, display an exact policy diff and require explicit operator confirmation for global authorization or visibility changes.
- Treat broad bootstrap permissions as temporary. Wrap smoke testing in
try/finallylogic that restores the original configuration and restarts the gateway even if validation fails. - Retain a uniquely named, timestamped backup rather than overwriting a single
.bakfile. - Validate the effective parsed configuration after the restart and confirm that only the intended agents can access only the required sessions.
- Make the least-privilege setup the documented default. If a broad diagnostic mode remains available, clearly label it as an exceptional, time-limited troubleshooting option.
- Replace the wildcard