Security readout for executives and security teams
Plain-English summary
OpenClaw before 2026.3.7 lets an authorized sandboxed session cross an intended isolation boundary through the /acp spawn command when ACP is enabled. The business risk is unauthorized host-side actions from a context expected to be constrained, mainly integrity impact rather than service outage.
Executive priority
Prioritize remediation during the next security maintenance window, faster where OpenClaw handles sensitive workflows or untrusted internal users. This is not evidenced as actively exploited, but sandbox escapes weaken a core control boundary.
Technical view
CVE-2026-27646 is a CWE-863 authorization flaw in OpenClaw's /acp spawn command. A low-privileged authorized sandboxed session can initialize host-side ACP runtime, bypassing sandbox restrictions. The supplied CVSS is 6.1 with local access, low complexity, low privileges, no user interaction, low confidentiality impact, and high integrity impact.
Likely exposure
Exposure appears limited to OpenClaw deployments running versions prior to 2026.3.7, with ACP enabled, and users or sessions authorized inside the sandboxed chat context. The bundle does not support anonymous internet exposure.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. Exploitation requires an authorized sandboxed session and ACP being enabled. The issue is a sandbox escape path, not a general remote unauthenticated compromise based on available evidence.
Researcher notes
Evidence is limited to the provided CVE, vendor advisory, patch reference, and VulnCheck advisory. Validate exact affected builds and ACP configuration locally. Avoid assuming broader product impact or exploit availability beyond the described /acp spawn sandbox escape.
Mitigation direction
- Upgrade OpenClaw to 2026.3.7 or later.
- Review the GitHub advisory and patch commit for vendor-specific remediation details.
- If upgrade is delayed, check vendor guidance on disabling or restricting ACP.
- Limit authorized sandboxed session access to trusted users until patched.
- Monitor for unexpected /acp spawn usage in sandboxed contexts.
Validation and detection
- Inventory OpenClaw deployments and identify versions earlier than 2026.3.7.
- Confirm whether ACP is enabled in each deployment.
- Review access controls for users allowed into sandboxed sessions.
- Check logs for unexpected /acp spawn activity from sandboxed sessions.
- Verify upgraded deployments report OpenClaw 2026.3.7 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-27646 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N1.84.2VulnCheckCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
5.8MediumVector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-9q36-67vc-rrwg)CVE reference, VulnCheck · vendor-advisory
- Patch CommitCVE reference, VulnCheck · patch
- VulnCheck AdvisoryCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.