Openclaw CVE-2026-41329

Requires authenticated network access (PR:L) to the OpenClaw service's heartbeat mechanism-the attacker must possess valid low-privilege credentials to reach the vulnerable code path. The attack complexity is low (AC:L) but requires present attack technique capability (AT:P), suggesting exploitation depends on specific timing, state conditions, or environmental factors in the heartbeat processing logic that are achievable but not universally present. No user interaction required (UI:N). The vulnerability specifically manifests when the OpenClaw instance processes heartbeat context inheritance for authenticated users without properly validating the senderIsOwner parameter against trusted ownership records. Limits to exploitation: requires pre-existing authentication (not exploitable by anonymous attackers), and the AT:P modifier indicates some deployment-specific or timing-dependent condition must be satisfied beyond simply sending a crafted request. Deployments that do not expose the heartbeat mechanism to network-authenticated users or that run OpenClaw in isolated single-user mode may have reduced exposure.

This represents a CRITICAL real-world risk despite no confirmed EPSS or KEV data in the provided intelligence. The CVSS 4.0 score of 9.0 reflects maximum impact across all security objectives (confidentiality, integrity, availability) in both vulnerable and subsequent systems, indicating complete system compromise potential. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning exploitation can be automated and executed remotely without significant barriers beyond basic authentication (PR:L). The 'present attack technique' (AT:P) modifier suggests exploitation techniques are currently viable but may require specific timing or conditions. VulnCheck's dedicated advisory publication and GitHub security advisory indicate this is a verified, publicly disclosed vulnerability with remediation details available. The sandbox escape nature makes this a high-priority patching candidate for any deployment running OpenClaw in multi-user or untrusted input scenarios, as authenticated users can break containment and achieve full system-level privileges. The absence of EPSS data prevents quantifying exploitation probability, but the combination of network exposure, low complexity, and complete scope change warrants immediate remediation. Security teams should verify whether their OpenClaw deployment accepts authenticated network connections and prioritize accordingly.

An authenticated attacker with low-privilege network access to an OpenClaw server sends specially crafted heartbeat messages that manipulate the context inheritance chain and set the senderIsOwner parameter to claim ownership privileges. The server's insufficient validation accepts these falsified ownership claims, granting the attacker elevated privileges within the sandbox. The attacker then leverages these escalated privileges to break out of the sandbox environment entirely, achieving unauthorized code execution or data access at the system level beyond the intended game engine containment. Public GitHub commit and security advisory provide attackers with detailed understanding of the vulnerable code paths.