PT-2026-28447 · Openclaw · Openclaw

Tdjackey · Publicado 2026-03-29 · Atualizado 2026-03-31 · CVE-2026-32915

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description OpenClaw before version 2026.3.11 contains a sandbox boundary bypass issue. This allows leaf subagents to access the subagents control surface and resolve against a parent requester scope instead of their own session tree. A low-privilege sandboxed leaf worker can exploit insufficient authorization checks on subagent control requests to steer or kill sibling runs and cause execution with broader tool policies.

Recommendations Update OpenClaw to version 2026.3.11 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-32915

Produtos afetados

Openclaw

Referências · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-4w7m-58cg-cmff · Aviso do Fabricante
• https://reddit.com/r/pwnhub/comments/1s6yrk8/highseverity_openclaw_sandbox_bypass · Publicação no Reddit
• https://twitter.com/CveFindCom/status/2038250572097233142 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-sandbox-boundary-bypass-via-subagent-control-surface · Nota
• https://twitter.com/carloxthebot/status/2038831008296923166 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2038269894610084278 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2038653589036429497 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2038250158710730979 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32915 · Nota de Segurança