Executive brief
OpenClaw is an AI automation platform that orchestrates tasks across operating systems and platforms. A flaw in how it spawned new runtime sessions allowed a sandboxed (isolated) execution context to break out of its restrictions and initialize a full-access host-level component (ACP runtime). An attacker with a foothold in a sandboxed session could escalate privileges to access sensitive systems and data, bypassing isolation guardrails. This was patched by enforcing stricter isolation boundaries for the affected spawning mechanism.
Technical details
The vulnerability is a privilege-escalation / sandbox-boundary-bypass (CWE-269: Improper Privilege Management). The root cause was asymmetric enforcement of sandbox inheritance checks: the subagent runtime enforced sandbox inheritance, but the ACP runtime did not implement equivalent guardrails. A sandboxed requester session could call sessions_spawn(runtime="acp") without validation, allowing it to spawn an unsandboxed ACP runtime initialized on the host side. Fix: Deny ACP spawn when the requester runtime is sandboxed, and reject sandbox="require" for ACP runtime. This fail-closed approach prevents sandbox-boundary bypass. The fix is available in version 2026.3.2 (released 2026-03-03). No authentication or user interaction is required if the attacker already controls a sandboxed session; network reachability depends on deployment context.
Affected products
- OpenClaw openclaw <=2026.3.1
Timeline
- 2026-03-03: disclosed: Security advisory GHSA-474h-prjg-mmw3 published
- 2026-03-02: patched: Fix commits ac11f0af and c703aa0f merged; version 2026.3.2 released
- 2026-03: other: Reported by tdjackey