Openclaw EUVD-2026-16997

Requires OpenClaw before version 2026.3.11 with leaf subagent architecture deployed. Attacker must be a low-privilege sandboxed leaf worker with local process access. Exploits insufficient authorization checks on subagent control requests to access parent requester scope and sibling run controls.

The CVSS 4.0 score of 9.3 reflects critical impact across confidentiality, integrity, and availability in both vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), though the local attack vector (AV:L) and low-privilege requirement (PR:L) constrain initial access scenarios. Real-world risk is elevated in environments where OpenClaw processes untrusted code or operates as a multi-tenant orchestration platform-common in AI agent frameworks and workflow automation systems. The low attack complexity (AC:L) and no user interaction requirement (UI:N) make exploitation straightforward once local access is obtained. Without EPSS data or KEV listing, prioritization depends on deployment context: organizations running OpenClaw in shared environments or processing untrusted workflows should treat this as urgent due to the privilege escalation and denial-of-service potential. The authentication bypass tag indicates this undermines fundamental security boundaries. SSVC assessment suggests immediate patching for systems where OpenClaw mediates security-sensitive operations, as the technical impact enables both data exfiltration (broader tool policies) and operational disruption (killing sibling runs).

An attacker with low-privilege local access deploys a malicious leaf subagent within an OpenClaw workflow orchestration system. The compromised worker issues crafted control requests to the subagent API, bypassing sandbox boundaries to terminate competing sibling processes handling sensitive data transformations. By resolving against the parent requester's scope, the attacker's subagent gains access to elevated tool policies, enabling file system access or network operations denied to sandboxed workers. This results in data exfiltration or denial of service as legitimate workflow tasks are systematically killed. The low complexity and lack of user interaction requirements allow rapid exploitation once initial code execution is achieved in any leaf context.