En resumen
- CVE-2026-32048 es una vulnerabilidad CRÍTICO (CVSS 9.9) que afecta a openclaw (openclaw), openclaw.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.29%, mayor que el 21.8% de las vulnerabilidades.
- Solución: actualizar a 2026.3.1 o posterior.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.1
| 2026.3.1
|
| openclaw npm | < 2026.3.1
| 2026.3.1
|
Description
Summary
A sandboxed session could use cross-agent sessions_spawn to create a child under an agent configured with sandbox.mode="off", downgrading runtime confinement.
Impact
In mixed-agent setups that allow cross-agent spawning, a sandboxed requester could escape into an unsandboxed child runtime.
Fix
Spawn-time sandbox inheritance is now enforced: if the requester is sandboxed and the resolved child runtime would be unsandboxed, spawn is rejected.
Affected and Patched Versions
- Affected:
<= 2026.2.26
- Patched:
2026.3.1
NVD description
OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit this to spawn child runtimes with sandbox.mode set to off, bypassing runtime confinement restrictions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free