Which versions of Openclaw are affected by EUVD-2026-16997?

OpenClaw versions before 2026.3.11 contain a sandbox escape vulnerability allowing authenticated local users to bypass process isolation and manipulate sibling processes with elevated privileges,…. A patch is available.

How to fix or mitigate EUVD-2026-16997?

Within 24 hours: inventory all OpenClaw deployments and identify instances running versions before 2026.3.11. Within 7 days: apply vendor-released patch to OpenClaw 2026.3.11 or later across all affected systems; prioritize production environments with multi-agent configurations. Within 30 days: audit access logs for subagent control API calls from low-privilege accounts and review process isolation configurations post-patching.

Openclaw EUVD-2026-16997

Q: What is the CVSS score of EUVD-2026-16997?

EUVD-2026-16997 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-32915 CRITICAL

Incorrect Authorization (CWE-863)

2026-03-29 VulnCheck

Authentication Bypass Openclaw

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:47 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.11

EUVD ID Assigned

Mar 29, 2026 - 13:15 euvd

EUVD-2026-16997

Analysis Generated

Mar 29, 2026 - 13:15 vuln.today

CVE Published

Mar 29, 2026 - 12:44 nvd

CRITICAL 9.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.11.

DescriptionCVE.org

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf worker can steer or kill sibling runs and cause execution with broader tool policies by exploiting insufficient authorization checks on subagent control requests.

AnalysisAI

Sandbox escape in OpenClaw versions before 2026.3.11 enables low-privilege leaf subagents to bypass isolation boundaries and manipulate sibling processes with elevated tool policies. Local authenticated attackers can terminate competing worker threads, redirect execution flows, and execute operations outside their intended security context by exploiting insufficient authorization on subagent control APIs. EPSS data not available for this recent CVE; no public exploit identified at time of analysis, though the technical advisory provides detailed vulnerability mechanics.

Technical ContextAI

OpenClaw implements a hierarchical subagent architecture where leaf workers operate in sandboxed execution contexts with restricted tool policies and isolated session trees. The vulnerability exists in the subagent control surface authorization layer, which fails to validate that control requests originate from appropriately scoped parent contexts. CWE-863 (Incorrect Authorization) manifests here as missing access control checks on inter-agent communication primitives. When a leaf subagent issues control commands (terminate, redirect, policy override), the system resolves these against the parent requester's scope rather than enforcing the leaf's own session boundary. This architectural flaw violates the principle of least privilege in multi-tenant agent orchestration systems, where each subagent should only control resources within its delegated security domain. The affected component is the request routing and authorization middleware that handles cross-agent RPC calls in the OpenClaw runtime.

RemediationAI

Upgrade immediately to OpenClaw version 2026.3.11 or later, which implements proper authorization checks on subagent control surface requests. The patch enforces scope validation to ensure leaf workers cannot issue control commands outside their delegated session trees. Organizations should verify that subagent control requests are authenticated against the originating context rather than parent scope after upgrade. Detailed remediation guidance is available in the vendor's security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-4w7m-58cg-cmff and comprehensive analysis at https://www.vulncheck.com/advisories/openclaw-sandbox-boundary-bypass-via-subagent-control-surface. No workarounds are documented; patching is the only effective mitigation. Post-upgrade, audit existing subagent configurations to ensure least-privilege tool policies are correctly enforced at each hierarchy level.