rootpwn

medium · CVSS v3 3.3 · CVSS v4 4.8 · EPSS 0.00107

CVE-2026-100573

OpenClaw versions prior to 2026.8.1 have a sandbox policy bypass in the MCP loopback component, allowing sandboxed coding-agent sessions to

Overview

OpenClaw versions prior to 2026.8.1 have a sandbox policy bypass in the MCP loopback component, allowing sandboxed coding-agent sessions to invoke tools that are explicitly denied by the sandbox.tools.deny policy. This flaw enables attackers to list and execute prohibited tools, potentially exposing sensitive data or performing unintended actions. The vulnerability is rated medium severity with a CVSS v3 score of 3.3.

Description

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions the operator intended to exclude from the sandbox.

Impact

Confidentiality: attackers can access data exposed by denied tools. Integrity: they can perform actions the operator intended to block. Availability: not directly impacted. Defenders: system administrators and operators of OpenClaw environments.

Remediation

Apply the 2026.8.1 patch or later to fix the sandbox policy bypass. Verify that sandbox.tools.deny policies are correctly configured and enforce the intended restrictions. Enable logging of tool invocation attempts and regularly audit logs for unauthorized activity.

Risk context

The vulnerability has a medium severity rating (CVSS v3 3.3) and a very low EPSS score of 0.00107, indicating a low likelihood of exploitation in the wild. Nonetheless, defenders should prioritize patching to 2026.8.1 or later and validate sandbox configurations promptly.

Affected products

  • OpenClaw

Scores

Severity
medium
CVSS v2
1.7
CVSS v3
3.3
CVSS v4
4.8
EPSS
0.00107

sandbox policy-bypass OpenClaw medium-severity MCP denied-tools patch

← All CVEs

Related CVEs

medium

CVE-2026-86609

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.

View analysis

medium

CVE-2025-71422

CVE-2025-71422 affects Contrast Kubernetes runtime versions before 1.12.1. A malicious host can supply a crafted LUKS2 secure persistent volume whose metadata is not authenticated, causing the guest to open it with a null keyslot cipher and expose secret data. It matters because confidential-container workloads may lose confidentiality of data written to secure persistent volumes.

View analysis

medium

CVE-2025-71424

CVE-2025-71424 affects Edgeless Systems Contrast versions up to 1.9.0, a runtime for confidential containers on Kubernetes. On bare-metal deployments, an image that declares a Dockerfile VOLUME without a matching Kubernetes mount can allow the host to write files under that mount point inside the confidential container. This matters because it can corrupt application-critical directories and undermine the integrity guarantees of the workload.

View analysis

medium

CVE-2026-100724

CVE-2026-100724 affects http4k-core versions before 6.49.0.0, 5.42.0.0, and 4.51.0.0. Its reverseProxy and reverseProxyRouting functions can match Host headers using substring logic when multiple virtual hosts are configured. This matters when the functions are exposed as public inbound HTTP handlers because routing-based authorization can be bypassed.

View analysis