CVSS 4.0
9.3 criticalCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HCVE-2026-32915
Critical (9.3) in openclaw openclaw. EPSS 0.1% chance of exploitation in the next 30 days. Fixed in openclaw 2026.3.11.
OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf worker can steer or kill sibling runs and cause execution with broader tool policies by exploiting insufficient authorization checks on subagent control requests.
Severity
CVSS 3.1
8.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openclaw:openclaw
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4w7m-58cg-cmff | npm | openclaw | <2026.3.11 | 2026.3.11 |