OpenClaw CVE-2026-100573

Requires an already-running sandboxed coding-agent session in OpenClaw with an MCP loopback component active and an operator-defined sandbox.tools.deny policy in place. The attacker must be able to drive that sandboxed session (local access to the session context, e.g., via a steered/malicious agent task) - this is not remotely reachable without such a session, hence AV:L and PR:L. Impact is limited by exactly which tools the operator denied: a deny-list of benign tools yields minor exposure, while denied high-capability tools raise the stakes. No user interaction beyond the attacker's own session control is needed. Fixed in 2026.8.1.

This is a genuinely low-priority issue despite carrying a 'sandbox bypass' label. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, base 4.8) tells the real story: exploitation is LOCAL (the attacker must already possess a sandboxed coding-agent session), requires low privileges within that session, and yields only LOW confidentiality impact per the vendor. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so all threat-intelligence signals point to no observed or predicted exploitation. The vulnerability is a policy-enforcement gap (CWE-862 Missing Authorization) rather than a memory-safety or RCE flaw. One tension worth noting: the vendor scored VI:N/VA:N (no integrity/availability impact), yet the description explicitly states attackers can 'perform actions the operator intended to exclude' - invoking denied tools plausibly carries at least low integrity impact, which I reflect in my independent assessment. The real-world risk ceiling is entirely determined by WHICH tools the operator placed in sandbox.tools.deny; the CVE abstracts that away, so the '4.8' is a floor for a benign deny-list and could be higher where dangerous tools were denied. Net: not a fire-drill; patch on normal cadence.

An attacker who already controls or influences a sandboxed coding-agent session (e.g., via a malicious prompt/task steering the agent) uses the MCP loopback path to enumerate and call tools the operator explicitly placed on the sandbox.tools.deny list, reaching data or capabilities meant to be walled off from the sandbox. No public exploit code exists; exploitation is local to an existing sandbox session and constrained by which tools were denied.