Description
OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions the operator intended to exclude from the sandbox.
Published: 2026-09-26
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized tool execution
Action: Patch
AI Analysis

Impact

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass that enables sandboxed coding‑agent sessions to list and invoke tools that are explicitly denied by sandbox.tools.deny. The flaw allows an attacker to access data or perform actions that the operator intended to prevent, essentially breaking the isolation that the sandbox was meant to enforce.

Affected Systems

OpenClaw software from the vendor OpenClaw, all releases earlier than 2026.8.1.

Risk and Exploitability

With a CVSS score of 4.8 this vulnerability falls into the low‑moderate severity range; EPSS data is not available, and it is not listed in the CISA KEV catalog. The attack vector is inferred to require compromise of a sandboxed coding‑agent session, which could be achieved remotely by exploiting vulnerabilities in the OpenClaw service or locally by an insider. Because the flaw allows execution of previously blocked tools, successful exploitation could lead to unauthorized data access or process execution within the sandbox environment.

Generated by OpenCVE AI on September 26, 2026 at 04:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update OpenClaw to version 2026.8.1 or later to eliminate the sandbox policy bypass.
  • Verify that the sandbox.tools.deny policy is active and remains unchanged after the update.
  • Monitor coding‑agent session logs for attempts to list or invoke denied tools and investigate anomalies.

Generated by OpenCVE AI on September 26, 2026 at 04:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Description OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions the operator intended to exclude from the sandbox.
Title OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback
First Time appeared Openclaw
Openclaw openclaw
Weaknesses CWE-862
CPEs cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*
Vendors & Products Openclaw
Openclaw openclaw
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Openclaw Openclaw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-30T00:26:34.127Z

Reserved: 2026-09-26T01:03:10.863Z

Link: CVE-2026-100573

cve-icon Vulnrichment

Updated: 2026-09-30T00:26:29.463Z

cve-icon NVD

Status : Deferred

Published: 2026-09-26T03:17:04.743

Modified: 2026-09-30T01:16:34.900

Link: CVE-2026-100573

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T06:15:05Z

Weaknesses