CVE-2026-41329

Katalog CVE

CVSS 9.9 · Critical EPSS 0,52%

Kerentanan Incorrect Use of Privileged APIs pada openclaw. Skor CVSS 3.1 9.9 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation. Attackers can exploit improper context validation to bypass sandbox restrictions and achieve unauthorized privilege escalation.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-648: Incorrect Use of Privileged APIs

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-g5cg-8x5w-7jpm advisory vendor
• https://github.com/openclaw/openclaw/commit/a30214a624946fc5c85c9558a27c1580172374fd patch
• https://www.vulncheck.com/advisories/openclaw-sandbox-bypass-via-heartbeat-context-inheritance-and-senderisown... advisory pihak ketiga