Which versions of OpenClaw are affected by EUVD-2026-27251?

OpenClaw versions 2026.4.5 through 2026.4.9 contain a sandbox escape vulnerability that allows low-privileged remote attackers to execute arbitrary code on production infrastructure by bypassing…. A patch is available.

How to fix or mitigate EUVD-2026-27251?

Within 24 hours: Identify all OpenClaw deployments running versions 2026.4.5-2026.4.9 and document their network exposure. Within 7 days: Apply vendor patch (commit dffad08) or upgrade to OpenClaw 2026.4.10 or later on all affected agents; prioritize internet-facing and production-critical deployments. Within 30 days: Complete patching of all remaining instances; verify sandbox isolation through security testing; review agent access logs for suspicious routing parameter modifications.

OpenClaw EUVD-2026-27251

Q: What is the CVSS score of EUVD-2026-27251?

EUVD-2026-27251 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-42434 HIGH

Incorrect Authorization (CWE-863)

2026-05-05 VulnCheck

GHSA-736r-jwj6-4w23

Authentication Bypass Openclaw

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 05, 2026 - 12:54 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 05, 2026 - 12:37 vuln.today

cvss_changed

CVSS changed

May 05, 2026 - 12:37 NVD

8.8 (HIGH) 8.7 (HIGH)

Source Code Evidence Fetched

May 05, 2026 - 12:15 vuln.today

Analysis Generated

May 05, 2026 - 12:15 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.5.

DescriptionCVE.org

OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node. Attackers can bypass sandbox boundaries and route execution to remote nodes instead of intended sandbox paths.

AnalysisAI

Sandbox escape in OpenClaw 2026.4.5 through 2026.4.9 allows low-privileged remote attackers to bypass sandbox boundaries and route code execution to arbitrary remote nodes by overriding exec routing parameters with host=node. This breaks sandboxed agent isolation, enabling privilege escalation and unauthorized access to production infrastructure. VulnCheck publicly disclosed this vulnerability with vendor patch available (commit dffad08). No active exploitation (CISA KEV) confirmed, but public disclosure increases exploitation risk for organizations running vulnerable OpenClaw agent deployments.

Technical ContextAI

OpenClaw is an agent-based execution framework that uses sandbox isolation to contain untrusted workloads. The vulnerability stems from improper access control (CWE-863) in the exec routing mechanism. Sandboxed agents are designed to execute only within their designated isolated environments, but the routing layer fails to validate or sanitize the host parameter. By specifying host=node in execution requests, an attacker with low-privilege sandboxed agent access can redirect execution calls from the sandbox path to arbitrary remote nodes in the OpenClaw cluster. This breaks the fundamental security boundary between sandboxed and production environments. The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation requiring only low-privilege credentials with no attack complexity, while the unchanged Scope (SC:N/SI:N/SA:N) confirms impact is confined to the vulnerable component's authorization boundary rather than affecting other systems.

RemediationAI

Upgrade immediately to OpenClaw version 2026.4.10 or later, which contains the fix per vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-736r-jwj6-4w23. The specific patch commit is dffad08529202edbf34e4808788e1182fe10f6a9 available at https://github.com/openclaw/openclaw/commit/dffad08529202edbf34e4808788e1182fe10f6a9. If immediate patching is not feasible, implement compensating controls: restrict network access to OpenClaw agents using firewall rules allowing only trusted source IPs to the exec routing endpoints (trade-off: breaks legitimate remote agent access), enforce strict authentication and authorization policies for all sandboxed agent credentials with mandatory MFA (reduces PR:L to PR:H but does not eliminate vulnerability), and enable comprehensive logging and monitoring for exec routing calls with host parameter usage to detect exploitation attempts (detection-only control, does not prevent exploitation). Disable or remove sandboxed agent functionality entirely if not required for operations until patching is complete (high operational impact but eliminates attack surface).