CVE-2026-32048: OpenClaw sandbox escape

CISO Take

OpenClaw versions before 2026.3.1 contain a flaw in the cross-agent sessions_spawn operation where sandbox restrictions are not inherited by child processes, allowing any authenticated user with a sandboxed session to instantiate child runtimes with sandbox.mode disabled and all confinement restrictions removed. Although no public exploit exists and CISA has not added this to KEV, the EPSS score places it in the top 80th percentile for exploitation likelihood, and the network-accessible, low-privilege attack vector means any authenticated user on a multi-tenant OpenClaw deployment is a viable threat actor. The CWE-732 root cause — incorrect permission assignment for a critical resource — is particularly dangerous in AI agent frameworks where sandboxing is often the primary and sole containment boundary between agentic code execution and the host environment. Organizations running OpenClaw in multi-agent or multi-tenant configurations should upgrade to 2026.3.1 immediately; where patching is not immediately feasible, restrict or disable access to the sessions_spawn API endpoint as a compensating control.

Sources: NVD EPSS GitHub Advisory ATLAS vulncheck.com

What is the risk?

High risk for organizations using OpenClaw in multi-agent orchestration or multi-tenant deployments. CVSS 7.5 with a network attack vector and low privilege requirement means any authenticated user is a potential attacker; High attack complexity moderates the immediate exploitation window but does not eliminate it given the EPSS 80th-percentile ranking. The absence of sandbox enforcement in AI agent frameworks is particularly severe because agents typically execute tool calls with broad host access — a sandbox escape translates directly to unrestricted environment access beyond what the session was authorized for. The 396 other CVEs catalogued in this package signal a historically poorly-secured codebase that warrants architectural scrutiny beyond this single issue.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege sandboxed session on an OpenClaw deployment via a trial account, compromised credential, or legitimate tenant access.

AML.T0012

Exploitation

Attacker calls the sessions_spawn API from within the sandboxed session with child parameters specifying sandbox.mode=off, triggering the inheritance flaw in the cross-agent session handler.

AML.T0053

Sandbox Escape

Child runtime is instantiated under an unsandboxed agent context, granting the attacker a process with no confinement restrictions and access to the full OpenClaw host environment.

AML.T0105

Impact

Attacker uses the unsandboxed child agent to exfiltrate environment secrets and API keys, access out-of-scope filesystem paths, pivot to co-tenant data, or execute arbitrary host-level commands.

AML.T0048

Initial Access

Attacker obtains a low-privilege sandboxed session on an OpenClaw deployment via a trial account, compromised credential, or legitimate tenant access.

AML.T0012

Exploitation

Attacker calls the sessions_spawn API from within the sandboxed session with child parameters specifying sandbox.mode=off, triggering the inheritance flaw in the cross-agent session handler.

AML.T0053

Sandbox Escape

Child runtime is instantiated under an unsandboxed agent context, granting the attacker a process with no confinement restrictions and access to the full OpenClaw host environment.

AML.T0105

Impact

Attacker uses the unsandboxed child agent to exfiltrate environment secrets and API keys, access out-of-scope filesystem paths, pivot to co-tenant data, or execute arbitrary host-level commands.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

4 steps

Patch: Upgrade OpenClaw to version 2026.3.1 — the vendor advisory confirms this release enforces sandbox inheritance during sessions_spawn.
Workaround (if immediate patching is not feasible): Restrict or disable the sessions_spawn API endpoint at the network or application layer; alternatively, enforce uniform sandbox configurations across all agent sessions to eliminate the privilege differential that the flaw exploits.
Detection: Audit OpenClaw runtime logs for sessions_spawn calls issued from sandboxed sessions that result in child sessions with sandbox.mode=off or absent; alert on any unsandboxed process creation where the parent context was sandboxed.
Defense-in-depth: If your deployment relies on OpenClaw sandboxing as the primary isolation boundary, add a secondary containment layer (container, OS namespace, or VM) so that a sandbox escape does not immediately yield host-level access.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0053 - AI Agent Tool Invocation AML.T0097 - Virtualization/Sandbox Evasion AML.T0105 - Escape to Host AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9 - Information security, data security and privacy protection of AI systems

NIST AI RMF

MANAGE 2.4 - Risks are prioritized and addressed based on impact

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32048?

OpenClaw versions before 2026.3.1 contain a flaw in the cross-agent sessions_spawn operation where sandbox restrictions are not inherited by child processes, allowing any authenticated user with a sandboxed session to instantiate child runtimes with sandbox.mode disabled and all confinement restrictions removed. Although no public exploit exists and CISA has not added this to KEV, the EPSS score places it in the top 80th percentile for exploitation likelihood, and the network-accessible, low-privilege attack vector means any authenticated user on a multi-tenant OpenClaw deployment is a viable threat actor. The CWE-732 root cause — incorrect permission assignment for a critical resource — is particularly dangerous in AI agent frameworks where sandboxing is often the primary and sole containment boundary between agentic code execution and the host environment. Organizations running OpenClaw in multi-agent or multi-tenant configurations should upgrade to 2026.3.1 immediately; where patching is not immediately feasible, restrict or disable access to the sessions_spawn API endpoint as a compensating control.

Is CVE-2026-32048 actively exploited?

No confirmed active exploitation of CVE-2026-32048 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32048?

1. Patch: Upgrade OpenClaw to version 2026.3.1 — the vendor advisory confirms this release enforces sandbox inheritance during sessions_spawn. 2. Workaround (if immediate patching is not feasible): Restrict or disable the sessions_spawn API endpoint at the network or application layer; alternatively, enforce uniform sandbox configurations across all agent sessions to eliminate the privilege differential that the flaw exploits. 3. Detection: Audit OpenClaw runtime logs for sessions_spawn calls issued from sandboxed sessions that result in child sessions with sandbox.mode=off or absent; alert on any unsandboxed process creation where the parent context was sandboxed. 4. Defense-in-depth: If your deployment relies on OpenClaw sandboxing as the primary isolation boundary, add a secondary containment layer (container, OS namespace, or VM) so that a sandbox escape does not immediately yield host-level access.

What systems are affected by CVE-2026-32048?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-32048?

CVE-2026-32048 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0053 AI Agent Tool Invocation

AML.T0097 Virtualization/Sandbox Evasion

AML.T0105 Escape to Host

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit this to spawn child runtimes with sandbox.mode set to off, bypassing runtime confinement restrictions.

Exploitation Scenario

An attacker who has obtained low-privilege access to a multi-tenant OpenClaw deployment — via a trial account, compromised user credential, or insider threat — initiates a sandboxed session as intended by the platform. They then call the sessions_spawn API with child session parameters that explicitly set sandbox.mode to off, exploiting the framework's failure to enforce inheritance. The resulting child runtime executes with no sandbox restrictions. The attacker uses this unsandboxed child agent to invoke tool calls that read environment variables (yielding API keys and secrets), access filesystem paths outside the intended sandbox boundary, make outbound network connections to exfiltrate data, or pivot to co-tenant data accessible under the shared OpenClaw host process. In an automated agent pipeline, this could be chained with an AML.T0051 prompt injection to trigger the sessions_spawn call without any direct attacker authentication.

Weaknesses (CWE)

CWE-732 Incorrect Permission Assignment for Critical Resource

CWE-732 — Incorrect Permission Assignment for Critical Resource: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

[Implementation] When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]

Source: MITRE CWE corpus.