Sandbox Bypass Vulnerability in OpenClaw by OpenClaw
CVE-2026-41329

9CRITICAL

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
20 April 2026

What is CVE-2026-41329?

OpenClaw versions prior to 2026.3.31 are susceptible to a sandbox bypass vulnerability that allows an attacker to escalate privileges. This issue arises from improper validation of context in the heartbeat mechanism. Malicious actors can exploit the vulnerabilities by manipulating the senderIsOwner parameter, thereby bypassing sandbox restrictions and gaining unauthorized access. Users are strongly urged to update their OpenClaw installations to mitigate this risk.

Affected Version(s)

OpenClaw 0 < 2026.3.31

OpenClaw 2026.3.31

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/a30214a624946...
patch
https://www.vulncheck.com/advisories/openclaw-sandbox-byp...
third-party-advisory

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AntAISecurityLab
.