CVE-2026-32048

Katalog CVE

CVSS 9.9 · Critical EPSS 0,41%

Kerentanan Incorrect Permission Assignment for Critical Resource pada openclaw. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit this to spawn child runtimes with sandbox.mode set to off, bypassing runtime confinement restrictions.

Rincian

Terbit di NVD

21 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-p7gr-f84w-hqg5 advisory vendor
• https://www.vulncheck.com/advisories/openclaw-sandbox-escape-via-cross-agent-sessions-spawn advisory pihak ketiga