Which versions of Openclaw are affected by CVE-2026-33573?

OpenClaw gateway agent versions prior to 2026.3.11 contain an authorization bypass vulnerability allowing authenticated operators to execute arbitrary operations outside their assigned workspace…. A patch is available.

How to fix or mitigate CVE-2026-33573?

Within 24 hours: Inventory all OpenClaw deployments and identify instances running versions prior to 2026.3.11; restrict operator.write permissions to least-privilege accounts pending patch deployment. Within 7 days: Apply vendor patch to upgrade all affected OpenClaw instances to version 2026.3.11 or later and validate patch application in non-production environments first. Within 30 days: Audit operator activity logs for the past 90 days to detect unauthorized workspace boundary traversal or out-of-scope file/exec operations; review and re-baseline operator role assignments.

Openclaw CVE-2026-33573

Q: What is the CVSS score of CVE-2026-33573?

CVE-2026-33573 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17026 HIGH

Exposure of Resource to Wrong Sphere (CWE-668)

2026-03-29 VulnCheck

GHSA-5w3r-prr4-7j25

Information Disclosure Openclaw

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:11 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.11

EUVD ID Assigned

Mar 29, 2026 - 13:15 euvd

EUVD-2026-17026

Analysis Generated

Mar 29, 2026 - 13:15 vuln.today

CVE Published

Mar 29, 2026 - 12:44 nvd

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.11.

DescriptionCVE.org

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled spawnedBy and workspaceDir values. Remote operators can escape the configured workspace boundary and execute arbitrary file and exec operations from any process-accessible directory.

AnalysisAI

Authorization bypass in OpenClaw gateway agent RPC enables authenticated operators with operator.write permission to escape workspace boundaries and execute arbitrary operations outside designated directories. Attackers supply malicious spawnedBy and workspaceDir parameters to perform file and exec operations from any process-accessible location. CVSS 8.7 reflects high confidentiality, integrity, and availability impact with network attack vector and low complexity. No public exploit identified at time of analysis, though EPSS data unavailable. VulnCheck identified this as an information disclosure vector affecting OpenClaw versions prior to 2026.3.11.

Technical ContextAI

OpenClaw is a gateway agent framework implementing RPC-based workspace management for operator-driven automation. The vulnerability (CWE-668: Exposure of Resource to Wrong Sphere) occurs when the gateway agent RPC interface fails to validate workspace boundary constraints on operator-supplied parameters. The spawnedBy and workspaceDir fields accept attacker-controlled values without proper authorization checks beyond the initial operator.write permission verification. This allows operators to reference directory paths outside their designated workspace scope, violating the intended isolation model. The affected product (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) processes these parameters during file and exec operations, treating operator-controlled paths as trusted without re-validating workspace membership. This represents a confused deputy problem where the agent's elevated privileges are misused to access resources the operator should not control.

RemediationAI

Upgrade immediately to OpenClaw version 2026.3.11 or later, which implements proper workspace boundary validation for spawnedBy and workspaceDir parameters in the gateway agent RPC interface. The vendor-released patch is available through standard OpenClaw distribution channels. Review the security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-2rqg-gjgv-84jm for complete upgrade instructions and any configuration changes required post-patching. As an interim mitigation if immediate patching is infeasible, restrict operator.write permission to only highly trusted operators, implement network segmentation to limit gateway agent RPC access, and enable comprehensive audit logging for all file and exec operations to detect potential workspace escape attempts. Additional technical analysis is available at https://www.vulncheck.com/advisories/openclaw-workspace-boundary-bypass-via-agent-rpc-parameters for organizations requiring deeper understanding before deployment.