PT-2026-28447 · Openclaw · Openclaw
CVSS v4.0
9.3
Crítica
| Vetor | AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.3.11
Description
OpenClaw before version 2026.3.11 contains a sandbox boundary bypass issue. This allows leaf subagents to access the subagents control surface and resolve against a parent requester scope instead of their own session tree. A low-privilege sandboxed leaf worker can exploit insufficient authorization checks on subagent control requests to steer or kill sibling runs and cause execution with broader tool policies.
Recommendations
Update OpenClaw to version 2026.3.11 or later.
Exploit
Correção
Improper Privilege Management
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Openclaw