EUVD-2026-87462
GHSA-2pcx-9jr9-59mg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessControl sandboxed agent input
-
DeliveryInvoke browser tool paired-node selection
-
ExploitBypass allowHostControl=false check
-
ExecutionIssue host browser operations
-
ImpactAccess authenticated browser profile and session state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an OpenClaw deployment running a sandboxed session with the browser tool that is paired to a host node, specifically while allowHostControl=false is configured (the exact control this bug defeats). The attacker must be able to control or influence the input the sandboxed agent acts on (attacker-controlled content or prompt-injected instructions steering the agent). There is no host-side authentication check to clear beyond low-privilege sandbox input access (PR:L), and no user interaction is required (UI:N); realistic risk is limited to environments that actually pair a host browser and feed untrusted content into the sandbox. |
| Impact | This is a genuine authorization-bypass (CWE-863) in OpenClaw's browser tool that defeats an explicit security control (allowHostControl=false), so it warrants real attention despite no exploitation telemetry. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L, score 8.7) indicates network reach, low complexity, and only low-privilege access to sandboxed agent input - a very achievable bar in agent/LLM deployments where untrusted content routinely flows into the sandbox. The high confidentiality/integrity impact is credible because reaching the paired host browser exposes and lets an attacker manipulate an authenticated browser profile (session cookies, logged-in state). No EPSS score, KEV listing, or public POC is present in the input, so there is no evidence of active exploitation; this is a high-quality-finding, patch-promptly issue rather than a mass-exploited emergency. One caveat: the 4.0 vector sets SC:N/SI:N (no subsequent-system impact), yet the vulnerability is fundamentally a sandbox-to-host escape, which arguably represents a scope change - I model that as S:C in 3.1 below. |
| Exploit ScenarioDerived | An attacker who can influence what a sandboxed OpenClaw agent processes (e.g. via a malicious web page, document, or prompt-injected instruction) directs the agent's browser tool to select a paired node and issue host browser actions, even though allowHostControl=false is set. This lets them inspect or drive the operator's real, authenticated browser profile - reading session state or performing actions as the logged-in user. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
OpenClaw deployments before 2026.7.1 contain an authorization-bypass flaw in the browser tool that lets a sandboxed session reach a paired host node's browser actions even when allowHostControl=false is set, so an attacker who can steer sandboxed agent input (e.g., via untrusted content or prompt injection) can inspect or manipulate the connected browser profile and its authenticated state. The issue affects remote, low-privilege, unauthenticated-at-the-network sandbox input paths (CVSS 8.7, vector PR:L/UI:N), and there is no public exploit identified at time of analysis; risk is concentrated in deployments that actually pair a host browser and feed untrusted content into the sandbox.
RemediationAI
Upgrade OpenClaw to 2026.7.1 or later, which is the vendor-released fix version for this sandbox-bypass issue; confirm the patched build via the GHSA-9x88-f7rh-4c83 advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-9x88-f7rh-4c83 and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-sandbox-bypass-via-browser-node. If upgrading immediately is not possible, apply compensating controls that address the specific bypass path: avoid pairing a host browser node with sandboxed sessions that consume untrusted or externally influenced content, since allowHostControl=false alone is not enforced correctly and cannot be relied on as a boundary; or disable the browser tool in sandboxed session configurations until the patch is applied, accepting the loss of browser capability for those agents. Also treat any browser profile previously reachable from a sandbox as potentially exposed and review its authenticated sessions, rotating credentials or cookies for accounts the paired profile held, and sanitize/limit untrusted input routed into agent prompts to reduce prompt-injection reachability. Each workaround reduces functionality, so pair them with prompt-injection filtering and monitoring until the 2026.7.1 upgrade completes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw's browser tool is designed to let an agent interact with browser profiles, but its sandbox model relies on the allowHostControl flag to deny sandboxed sessions access to host-side "paired node" browser actions. CWE-863 (Incorrect Authorization) is the root cause: the authorization decision for host browser operations is checked inconsistently, so a sandboxed session that should be blocked can still select a paired host node and invoke its browser actions. The affected CPE is cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* for versions below 2026.7.1. This is a control-plane/authorization boundary failure rather than memory corruption: the sandbox isolation intent is defeated, allowing the agent to pivot from its isolated context to the host's authenticated browser session. VulnCheck reported and corroborated the issue via the vendor GHSA advisory (GHSA-9x88-f7rh-4c83), and the vector's scope-relevant assessment (S:C with high C/I impact) reflects the crossing of the sandbox boundary.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
PR:L for control of sandboxed agent input, no UI needed; S:C because it escapes the sandbox to act on the host browser; C:H/I:H for reading/manipulating authenticated profile, A:L minor.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over sandboxed agent input can select a paired node and perform host browser operations, inspecting or manipulating the connected browser profile and its authenticated state.
Articles & Coverage 1
Technical POC Analysis
Evidence base: the GHSA-9x88-f7rh-4c83 advisory only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
OpenClaw versions before 2026.7.1 have a security control failure in their browser integration that could allow a restricted agent session to access a connected host browser, risking exposure or misuse of logged-in web sessions. Organizations that connect host browsers to OpenClaw while processing untrusted content are most exposed, as compromised sessions could enable data leakage or unauthorized actions in business applications. Although no public exploit has been identified at time of analysis, the high-severity rating (CVSS 8.7) means leadership should prioritize configuration review and a rapid upgrade or mitigation plan for affected OpenClaw deployments.
No vendor-released patch identified at time of analysis; disable the OpenClaw browser tool, avoid pairing host browser nodes with sandboxes that process untrusted content, do not rely on allowHostControl=false alone, restrict sandbox input to trusted sources, isolate affected deployments, and monitor for anomalous browser-profile or authenticated-session activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
Exploit-DB