PT-2026-26729 · Openclaw · Openclaw

Rafael M · Publicado 2026-03-03 · Atualizado 2026-03-21 · CVE-2026-32046

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.21

Description The software contains an improper sandbox configuration that could allow attackers to execute arbitrary code. This is achieved by exploiting renderer-side issues without needing to escape the sandbox. The OS-level sandbox protections within the Chromium browser container are disabled, enabling code execution on the host system.

Recommendations Update OpenClaw to version 2026.2.21 or later.

Correção

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-693

CWE-1188

Identificadores relacionados

CVE-2026-32046

GHSA-43X4-G22P-3HRQ

GHSA-Q94V-V6M9-JHQ9

Produtos afetados

Openclaw

Referências · 10

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/commit/e7eba01efc4c3c400e9cfd3ce3d661cbc788a631 · Correção
• https://github.com/openclaw/openclaw/security/advisories/GHSA-43x4-g22p-3hrq · Aviso do Fabricante
• https://github.com/openclaw/openclaw/commit/1835dec2004fe7a62c6a7ba46b8485f124ec6199 · Correção
• https://twitter.com/CVEnew/status/2035262088734523892 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32046 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32046 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-q94v-v6m9-jhq9 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-43x4-g22p-3hrq · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-os-level-sandbox-bypass-via-no-sandbox-flag · Nota