OpenClaw versions prior to 2026.3.31 are vulnerable to a sandbox bypass that enables attackers to elevate privileges by manipulating heartbeat context inheritance and the senderIsOwner flag. The flaw arises from improper validation of the heartbeat context, allowing a malicious actor to bypass sandbox restrictions and execute code or actions with elevated rights.

All releases of OpenClaw before 2026.3.31, as indicated by the CNA product entry and the version locator "< 2026.3.31". The vulnerability applies to the node.js implementation of the product, as reflected in the CPE data.

The CVSS score of 9 underscores a critical severity; the EPSS score of 0.00037 indicates a very low exploitation probability, and the lack of a KEV listing suggests no current widespread exploitation, but the potential impact remains high. Attackers must be able to influence heartbeat context or the senderIsOwner parameter, which is likely achievable through unauthorized API calls or client-side manipulation. Given the high CVSS rating and the nature of the flaw, the risk to confidentiality, integrity, and availability is significant if a sandbox bypass occurs. Based on the description, the likely attack vector involves manipulating the heartbeat context or the senderIsOwner flag through unauthorized API calls.