CVE-2026-41329
Sandbox Bypass in OpenClaw Enables Privilege Escalation
Publication date: 2026-04-21
Last updated on: 2026-04-27
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.3.31 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-648 | The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41329 is a critical vulnerability in OpenClaw versions before 2026.3.31 that allows attackers to bypass sandbox restrictions and escalate privileges. This happens due to improper validation of heartbeat context inheritance combined with manipulation of the senderIsOwner parameter. Essentially, attackers exploit these flaws to gain unauthorized elevated privileges within the OpenClaw environment.
How can this vulnerability impact me? :
This vulnerability can have severe impacts on the affected system. Attackers can remotely exploit it over a network with low attack complexity and no user interaction required. Successful exploitation leads to unauthorized privilege escalation, compromising the confidentiality, integrity, and availability of the vulnerable system and potentially any connected systems.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update OpenClaw to version 2026.3.31 or later, where the sandbox bypass issue has been fixed.
This update blocks owner-only authentication inheritance for exec events, preventing the privilege escalation via heartbeat context inheritance and senderIsOwner parameter manipulation.
Applying this patch will close the vulnerability and protect your system from unauthorized privilege escalation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to bypass sandbox restrictions and escalate privileges, leading to severe impacts on confidentiality, integrity, and availability of the affected system.
Such impacts on system security properties can potentially result in non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.
However, the provided information does not explicitly mention compliance implications or specific regulatory impacts.