OpenClaw releases prior to 2026.3.7 contain a sandbox escape flaw in the /acp spawn command. The weakness is a privilege escalation through a command invoked from a sandboxed chat context, allowing an authorized user to launch host‑side ACP runtime. This is a case of improper authorization, identified as CWE‑863, and it enables privileged code execution on the host system.

The flaw applies to all installations of OpenClaw prior to version 2026.3.7 when the ACP feature is active. Any user that has an authorized sandboxed session with ACP permissions can trigger the vulnerability.

The CVSS score of 5.8 indicates moderate severity, and the EPSS score of less than 1 % implies the likelihood of active exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation. The attack vector is inferred to require an authenticated sandboxed user with ACP enabled; therefore, only privileged users inside the sandbox pose a risk. The potential impact includes unauthorized host‑side code execution, which could compromise confidentiality, integrity, and availability of the underlying system if exploited.