Executive brief
OpenClaw is a multi-agent runtime platform that uses sandboxes to isolate and restrict what code can execute. A vulnerability allows attackers with sandboxed sessions to spawn child processes in unsandboxed agents, effectively escaping the sandbox restrictions. This could enable unauthorized access to system resources and capabilities that should be blocked by the sandbox.
Technical details
The vulnerability is an improper access control issue (CWE-284/CWE-269) in OpenClaw's sessions_spawn operation. When a sandboxed session performs cross-agent spawning, the platform fails to enforce sandbox inheritance—allowing a sandboxed requester to create child runtimes under agents configured with sandbox.mode="off". An authenticated attacker with a sandboxed session can exploit this by invoking sessions_spawn to create child processes in unsandboxed agents, bypassing runtime confinement restrictions. The fix enforces spawn-time sandbox inheritance validation: if the requester is sandboxed and the resolved child runtime would be unsandboxed, the spawn is rejected. Versions prior to 2026.3.1 are affected.
Affected products
- OpenClaw openclaw < 2026.3.1
Timeline
- 2026-03-02: advisory: Original advisory GHSA-p7gr-f84w-hqg5 published
- 2026-03-21: disclosed: Duplicate advisory GHSA-wr92-6w3g-2hwc published on OSV
- 2026-03-27: other: Duplicate advisory GHSA-wr92-6w3g-2hwc withdrawn