CVE-2026-41329

CRITICAL
2026-04-21 [email protected] GHSA-g5cg-8x5w-7jpm
Privilege Escalation
9.0
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Apr 21, 2026 - 00:39 vuln.today

DescriptionNVD

OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation. Attackers can exploit improper context validation to bypass sandbox restrictions and achieve unauthorized privilege escalation.

AnalysisAI

Sandbox bypass in OpenClaw (pre-2026.3.31) enables authenticated remote attackers to escalate privileges by manipulating heartbeat context inheritance and senderIsOwner parameters. Exploitation requires low attack complexity with present attack technique capability, achieving complete compromise of confidentiality, integrity, and availability across vulnerable and subsequent system scope. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Identify all systems running OpenClaw versions prior to 2026.3.31 and restrict network access to affected instances. Within 7 days: Upgrade OpenClaw to version 2026.3.31 or later. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-41329 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy