Which versions of Openclaw are affected by CVE-2026-41329?

CVE-2026-41329 is a critical sandbox bypass in OpenClaw versions prior to 2026.3.31 that allows authenticated users to escalate privileges and achieve complete system compromise.. A patch is available.

How to fix or mitigate CVE-2026-41329?

Within 24 hours: Identify all systems running OpenClaw versions prior to 2026.3.31 and restrict network access to affected instances. Within 7 days: Upgrade OpenClaw to version 2026.3.31 or later. Within 30 days: Conduct security audit of all authenticated user accounts and review access logs for suspicious privilege escalation attempts during the vulnerability window.

Openclaw CVE-2026-41329

Q: What is the CVSS score of CVE-2026-41329?

CVE-2026-41329 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

Incorrect Use of Privileged APIs (CWE-648)

2026-04-21 disclosure@vulncheck.com

GHSA-g5cg-8x5w-7jpm

Privilege Escalation Openclaw

9.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Patch released

Apr 21, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 21, 2026 - 00:39 vuln.today

Analysis Generated

Apr 21, 2026 - 00:22 vuln.today

CVE Published

Apr 21, 2026 - 00:16 nvd

CRITICAL 9.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.31.

DescriptionCVE.org

OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation. Attackers can exploit improper context validation to bypass sandbox restrictions and achieve unauthorized privilege escalation.

AnalysisAI

Sandbox bypass in OpenClaw (pre-2026.3.31) enables authenticated remote attackers to escalate privileges by manipulating heartbeat context inheritance and senderIsOwner parameters. Exploitation requires low attack complexity with present attack technique capability, achieving complete compromise of confidentiality, integrity, and availability across vulnerable and subsequent system scope. No active exploitation confirmed (not in CISA KEV), but VulnCheck disclosure indicates researcher-identified vulnerability with public GitHub commit and security advisory available.

Technical ContextAI

OpenClaw is an open-source game engine implementation. This vulnerability stems from CWE-648 (Incorrect Use of Privileged APIs), where the application fails to properly validate security context during heartbeat operations-a common mechanism for maintaining connection state or synchronization between components. The 'senderIsOwner' parameter appears to control privilege assertions within the sandbox environment. By inheriting or manipulating heartbeat context data, an attacker can falsify ownership claims and convince the sandbox validation logic to grant elevated privileges. The CVSS 4.0 vector indicates network attack surface (AV:N) with low complexity (AC:L) requiring present attack technique capability (AT:P) and low-level authentication (PR:L), suggesting the heartbeat mechanism accepts authenticated user input without sufficient origin or integrity validation. The Changed scope (S:C indicated by distinct SC/SI/SA High values) means successful exploitation breaks out of the intended security boundary, affecting resources beyond the vulnerable component itself.

RemediationAI

Upgrade immediately to OpenClaw version 2026.3.31 or later, which contains the fix committed in GitHub commit a30214a624946fc5c85c9558a27c1580172374fd (https://github.com/openclaw/openclaw/commit/a30214a624946fc5c85c9558a27c1580172374fd). Review the complete security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-g5cg-8x5w-7jpm for additional context. If immediate patching is not feasible, implement network segmentation to restrict authenticated access to the OpenClaw service to only trusted users, recognizing this reduces but does not eliminate risk since the vulnerability requires only low-privilege authentication. Consider disabling heartbeat functionality if the application permits and operational requirements allow, though this may impact connection stability or feature availability-consult application documentation for side effects. Monitor authentication logs for unusual privilege escalation attempts or repeated heartbeat requests with varying context parameters. Do not rely solely on sandbox containment as a control given the bypass nature of this vulnerability.