Which versions of Openclaw are affected by CVE-2026-27646?

CVE-2026-27646 presents moderate security risk, a incorrect authorization vulnerability rated CVSS 5.8. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-27646?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Openclaw CVE-2026-27646

Q: What is the CVSS score of CVE-2026-27646?

CVE-2026-27646 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14557 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-23 VulnCheck

Authentication Bypass Openclaw

5.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 22:00 euvd

EUVD-2026-14557

Analysis Generated

Mar 23, 2026 - 22:00 vuln.today

Patch released

Mar 23, 2026 - 22:00 nvd

Patch available

CVE Published

Mar 23, 2026 - 21:36 nvd

MEDIUM 5.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.7.

DescriptionCVE.org

OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime. Attackers can bypass sandbox restrictions by invoking the /acp spawn slash-command to cross from sandboxed chat context into host-side ACP session initialization when ACP is enabled.

AnalysisAI

OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn slash-command that allows authorized sandboxed users to initialize host-side ACP runtime and bypass sandbox restrictions. An attacker with low privileges and sandboxed chat access can invoke the vulnerable command to cross from isolated chat context into unrestricted host-side ACP session initialization when ACP is enabled, potentially escalating their capabilities beyond intended boundaries. The vulnerability has been assigned a CVSS score of 5.3 (medium severity) with a published patch available from the vendor.

Technical ContextAI

This vulnerability exploits improper access control (CWE-863: Incorrect Authorization) within OpenClaw's application context protocol (ACP) command handling system. The /acp spawn command, intended for legitimate ACP runtime initialization in host contexts, lacks sufficient sandbox boundary validation when invoked from sandboxed chat sessions. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), and the root cause involves the ACP subsystem failing to enforce context-aware authorization checks—specifically, it does not verify whether the invoking session possesses the necessary host-level privileges before transitioning from sandbox mode to host-side ACP initialization. This is a classic privilege escalation pattern where a low-privileged context can transition to higher-privileged runtime behavior through improper gating.

RemediationAI

Upgrade OpenClaw to version 2026.3.7 or later immediately. The vendor has released a patch available at https://github.com/openclaw/openclaw/commit/61000b8e4dde919ca1a825d4700db4cb3fdc56e3 as referenced in the official security advisory (https://github.com/openclaw/openclaw/security/advisories/GHSA-9q36-67vc-rrwg). Until patching is feasible, disable or restrict use of the /acp spawn command in sandbox contexts by implementing command-level access controls, disabling ACP features if not required, or isolating sandboxed session privileges to prevent invocation of host-level ACP initialization routines. Additionally, audit logs for any /acp spawn command invocations from low-privilege sessions to detect potential exploitation attempts.