CVE-2026-27646: OpenClaw sandbox escape

CISO Take

OpenClaw AI agent versions prior to 2026.3.7 contain an authorization flaw (CWE-863) in the /acp spawn slash-command that allows any authorized sandboxed session to cross the sandbox boundary and initialize the host-side ACP runtime, granting high-integrity write access to the underlying host. Despite a medium CVSS (6.1), the EPSS places this CVE in the 99th percentile for exploitation likelihood, and the attack requires only low privileges with no user interaction in any deployment where ACP is enabled — a low bar for insider threats or compromised agent sessions. No public exploit is currently available and it is not in CISA KEV, but sandbox escape primitives in AI agent frameworks are high-value pivoting tools for attackers seeking to move from a constrained agent context to host-level persistence. Organizations should upgrade to OpenClaw 2026.3.7 immediately and audit host logs for /acp spawn invocations originating from sandboxed sessions as an indicator of compromise.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium CVSS (6.1) understates contextual risk in AI agent deployments. The attack requires only local access with low privileges — consistent with insider threat, a compromised sandboxed session, or a malicious third-party skill executing within the agent runtime. High integrity impact means a successful escape grants write capabilities on the host. Non-KEV status and absence of a public exploit moderate immediate urgency, but the 99th EPSS percentile indicates the vulnerability pattern is highly exploitable relative to the full CVE population. Multi-tenant or shared OpenClaw deployments and environments where ACP is enabled by default face the greatest exposure.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege authorized account within an OpenClaw-enabled environment where ACP is active.

AML.T0012

Tool Invocation

Attacker issues the /acp spawn slash-command from within a sandboxed chat session, triggering the CWE-863 authorization flaw.

AML.T0053

Sandbox Escape

OpenClaw incorrectly permits the command to cross the sandbox boundary and initializes the host-side ACP runtime under the attacker's session context.

AML.T0105

Host Impact

Attacker leverages host-level write access to modify agent configuration, stage persistence, or exfiltrate host credentials and sensitive data.

AML.T0112.000

Initial Access

Attacker obtains or already holds a low-privilege authorized account within an OpenClaw-enabled environment where ACP is active.

AML.T0012

Tool Invocation

Attacker issues the /acp spawn slash-command from within a sandboxed chat session, triggering the CWE-863 authorization flaw.

AML.T0053

Sandbox Escape

OpenClaw incorrectly permits the command to cross the sandbox boundary and initializes the host-side ACP runtime under the attacker's session context.

AML.T0105

Host Impact

Attacker leverages host-level write access to modify agent configuration, stage persistence, or exfiltrate host credentials and sensitive data.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C Low

I High

A None

What should I do?

5 steps

Patch immediately: upgrade to OpenClaw >= 2026.3.7 (patch commit 61000b8e).
If patching is blocked, disable ACP entirely in your deployment configuration — the vulnerability requires ACP to be enabled and is not exploitable without it.
Audit host and application logs for /acp spawn invocations originating from sandboxed sessions; any occurrence on unpatched systems is a potential indicator of compromise.
Apply least-privilege to the OpenClaw host process (restrict filesystem and network permissions) to limit post-escape impact radius.
Inventory and patch the four known downstream dependents that inherit this exposure.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0053 - AI Agent Tool Invocation AML.T0105 - Escape to Host AML.T0107 - Exploitation for Defense Evasion AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI system impact assessment

NIST AI RMF

MANAGE 2.4 - Residual risks are managed

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-27646?

OpenClaw AI agent versions prior to 2026.3.7 contain an authorization flaw (CWE-863) in the /acp spawn slash-command that allows any authorized sandboxed session to cross the sandbox boundary and initialize the host-side ACP runtime, granting high-integrity write access to the underlying host. Despite a medium CVSS (6.1), the EPSS places this CVE in the 99th percentile for exploitation likelihood, and the attack requires only low privileges with no user interaction in any deployment where ACP is enabled — a low bar for insider threats or compromised agent sessions. No public exploit is currently available and it is not in CISA KEV, but sandbox escape primitives in AI agent frameworks are high-value pivoting tools for attackers seeking to move from a constrained agent context to host-level persistence. Organizations should upgrade to OpenClaw 2026.3.7 immediately and audit host logs for /acp spawn invocations originating from sandboxed sessions as an indicator of compromise.

Is CVE-2026-27646 actively exploited?

No confirmed active exploitation of CVE-2026-27646 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-27646?

1. Patch immediately: upgrade to OpenClaw >= 2026.3.7 (patch commit 61000b8e). 2. If patching is blocked, disable ACP entirely in your deployment configuration — the vulnerability requires ACP to be enabled and is not exploitable without it. 3. Audit host and application logs for /acp spawn invocations originating from sandboxed sessions; any occurrence on unpatched systems is a potential indicator of compromise. 4. Apply least-privilege to the OpenClaw host process (restrict filesystem and network permissions) to limit post-escape impact radius. 5. Inventory and patch the four known downstream dependents that inherit this exposure.

What systems are affected by CVE-2026-27646?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI agent deployments, AI agent orchestration pipelines.

What is the CVSS score for CVE-2026-27646?

CVE-2026-27646 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.10%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI agent deploymentsAI agent orchestration pipelines

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0105 Escape to Host

AML.T0107 Exploitation for Defense Evasion

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime. Attackers can bypass sandbox restrictions by invoking the /acp spawn slash-command to cross from sandboxed chat context into host-side ACP session initialization when ACP is enabled.

Exploitation Scenario

An attacker with a low-privilege authorized account in an OpenClaw-enabled environment — or a malicious skill embedded via the OpenClaw skills ecosystem — issues the /acp spawn slash-command from within a sandboxed chat session. Because CWE-863 incorrectly permits authorized sandboxed sessions to invoke this command across the sandbox boundary, OpenClaw initializes the host-side ACP runtime on behalf of the attacker. The attacker now holds a host-level ACP session with high-integrity write access, enabling modification of agent configuration files, staging of persistent backdoors, or exfiltration of host credentials and sensitive data, all from an initially sandboxed context that was never intended to have host-level reach.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.