CVE-2026-32915: OpenClaw sandbox bypass enables

CISO Take

CVE-2026-32915 allows a sandboxed leaf subagent in OpenClaw to escape its isolation boundary, resolving control surface requests against the parent session scope and gaining the ability to steer or terminate sibling agent runs with broader tool permissions. Despite no CISA KEV listing, this sits in the 96th EPSS percentile for exploitation likelihood, and the CVSS 8.8 rating with Changed scope means a single low-privilege entry point can cascade full CIA impact across the entire agent orchestration layer without requiring any user interaction. Any agentic pipeline where subagents hold differentiated tool policies — file system access, external API calls, credential stores — is exposed to cross-agent privilege escalation, and the package's 396-CVE history further erodes confidence in OpenClaw deployments. Upgrade to OpenClaw ≥2026.3.11 immediately; as a short-term workaround, flatten tool policies across all agent tiers to minimize the blast radius of a compromised leaf.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

High. The CVSS 8.8 score reflects a Changed scope with full CIA impact, meaning exploitation in one isolated subagent can cascade to the entire orchestration layer. Low attack complexity and no required user interaction lower the exploitation bar to any actor who can influence a leaf agent's inputs — a realistic scenario in multi-tenant or internet-facing agentic deployments. The 96th-percentile EPSS score signals elevated community interest in this class of vulnerability despite the absence of a public exploit. The package's 396-CVE history further erodes confidence in the overall security posture of OpenClaw-based deployments.

How does the attack unfold?

Initial Access

Adversary injects a malicious payload into a leaf subagent's input via a poisoned task, crafted data source, or prompt injection to gain execution within the sandboxed agent context.

AML.T0051

Sandbox Escape

The leaf agent sends control surface requests that OpenClaw incorrectly resolves against the parent session scope rather than the leaf's own tree, bypassing CWE-863 authorization checks.

AML.T0105

Lateral Movement

Attacker enumerates sibling agent runs and injects rogue instructions or terminates them, pivoting to agents holding broader tool permissions such as filesystem access or external API credentials.

AML.T0053

Impact

Execution assumes elevated tool policies of sibling or parent agents, enabling data exfiltration, unauthorized command execution, or denial of service across the full orchestration layer.

AML.T0086

Initial Access

Adversary injects a malicious payload into a leaf subagent's input via a poisoned task, crafted data source, or prompt injection to gain execution within the sandboxed agent context.

AML.T0051

Sandbox Escape

The leaf agent sends control surface requests that OpenClaw incorrectly resolves against the parent session scope rather than the leaf's own tree, bypassing CWE-863 authorization checks.

AML.T0105

Lateral Movement

Attacker enumerates sibling agent runs and injects rogue instructions or terminates them, pivoting to agents holding broader tool permissions such as filesystem access or external API credentials.

AML.T0053

Impact

Execution assumes elevated tool policies of sibling or parent agents, enabling data exfiltration, unauthorized command execution, or denial of service across the full orchestration layer.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

5 steps

Patch: upgrade OpenClaw to ≥2026.3.11, which enforces authorization checks on all subagent control surface requests against the requesting agent's own session tree.
Workaround if patching is delayed: apply uniform minimal tool policies across all agent tiers to reduce the privilege delta available via lateral movement.
Audit: review agent session tree configurations for any implicit trust relationships between siblings.
Detection: instrument subagent control surface calls and alert on any request referencing a session ID outside the caller's own subtree.
Compensating control: add out-of-band authorization validation for cross-agent control requests at the orchestrator level.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0034.002 - Agentic Resource Consumption AML.T0053 - AI Agent Tool Invocation AML.T0084 - Discover AI Agent Configuration AML.T0105 - Escape to Host AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.2 - AI roles and responsibilities

NIST AI RMF

MANAGE 2.4 - Mechanisms to sustain oversight and control

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32915?

CVE-2026-32915 allows a sandboxed leaf subagent in OpenClaw to escape its isolation boundary, resolving control surface requests against the parent session scope and gaining the ability to steer or terminate sibling agent runs with broader tool permissions. Despite no CISA KEV listing, this sits in the 96th EPSS percentile for exploitation likelihood, and the CVSS 8.8 rating with Changed scope means a single low-privilege entry point can cascade full CIA impact across the entire agent orchestration layer without requiring any user interaction. Any agentic pipeline where subagents hold differentiated tool policies — file system access, external API calls, credential stores — is exposed to cross-agent privilege escalation, and the package's 396-CVE history further erodes confidence in OpenClaw deployments. Upgrade to OpenClaw ≥2026.3.11 immediately; as a short-term workaround, flatten tool policies across all agent tiers to minimize the blast radius of a compromised leaf.

Is CVE-2026-32915 actively exploited?

No confirmed active exploitation of CVE-2026-32915 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32915?

1. Patch: upgrade OpenClaw to ≥2026.3.11, which enforces authorization checks on all subagent control surface requests against the requesting agent's own session tree. 2. Workaround if patching is delayed: apply uniform minimal tool policies across all agent tiers to reduce the privilege delta available via lateral movement. 3. Audit: review agent session tree configurations for any implicit trust relationships between siblings. 4. Detection: instrument subagent control surface calls and alert on any request referencing a session ID outside the caller's own subtree. 5. Compensating control: add out-of-band authorization validation for cross-agent control requests at the orchestrator level.

What systems are affected by CVE-2026-32915?

This vulnerability affects the following AI/ML architecture patterns: multi-agent orchestration, agent frameworks, agentic AI pipelines, AI sandbox environments.

What is the CVSS score for CVE-2026-32915?

CVE-2026-32915 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.14%.

What is the AI security impact?

Affected AI Architectures

multi-agent orchestrationagent frameworksagentic AI pipelinesAI sandbox environments

MITRE ATLAS Techniques

AML.T0034.002 Agentic Resource Consumption

AML.T0053 AI Agent Tool Invocation

AML.T0084 Discover AI Agent Configuration

AML.T0105 Escape to Host

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.2

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf worker can steer or kill sibling runs and cause execution with broader tool policies by exploiting insufficient authorization checks on subagent control requests.

Exploitation Scenario

An adversary injects a malicious payload into the input stream of a low-privilege leaf agent — for example, via a poisoned data source in a RAG pipeline or a crafted task submitted to a multi-agent workflow. Inside the sandboxed leaf, the payload triggers requests to the subagent control surface using the parent session scope rather than the leaf's own scope, which OpenClaw fails to validate per CWE-863. The attacker then enumerates sibling agent runs, injects instructions into a sibling with filesystem or external API access, and uses that sibling's tool policy to exfiltrate data or execute arbitrary commands — while the original leaf appears to operate normally within its sandbox boundary.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.