Security readout for executives and security teams
Plain-English summary
OpenClaw versions before 2026.3.11 can let a low-privilege sandboxed subagent cross intended boundaries and influence other agent runs. The business risk is loss of containment: work expected to run with limited authority may reach broader tool policies or disrupt sibling tasks.
Executive priority
Treat this as urgent for OpenClaw environments using agent delegation. The issue weakens sandbox isolation and can convert a low-privilege worker into a control point over broader automation.
Technical view
The flaw is an authorization failure in subagent control requests. A leaf worker can access the subagent control surface and have requests resolved against the parent requester scope rather than its own session tree, enabling sibling run steering, termination, and broader-policy execution.
Likely exposure
Organizations using OpenClaw before 2026.3.11 with sandboxed subagents or multi-agent workflows are the relevant exposure group. Evidence does not identify other affected products or deployments.
Exploitation context
The bundle reports CVSS 9.3, local attack vector, low privileges, no user interaction, and high confidentiality, integrity, and availability impact. KEV is false, and the provided sources do not state active exploitation.
Researcher notes
Classified as CWE-863 with a CVSS 4.0 score of 9.3. The key research focus is requester-scope resolution in subagent control paths. The source bundle does not provide proof-of-concept details or observed exploitation.
Mitigation direction
- Upgrade OpenClaw to 2026.3.11 or later, following vendor advisory guidance.
- Restrict creation and operation of low-privilege subagents until upgraded.
- Limit access to subagent control surfaces to explicitly authorized sessions.
- Review tool policies for workflows where subagents can affect sibling runs.
- Monitor vendor and CVE records for updated remediation details.
Validation and detection
- Inventory OpenClaw deployments and identify versions earlier than 2026.3.11.
- Confirm whether sandboxed leaf workers or subagent workflows are enabled.
- Review logs for unexpected sibling run termination or control actions.
- Validate authorization checks bind control requests to the caller session tree.
- Confirm upgraded systems report OpenClaw 2026.3.11 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-32915 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——VulnCheckCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-4w7m-58cg-cmff)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Subagent Control SurfaceCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.