CVE-2026-32048
CVE-2026-32048 · OpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit this to spawn child runtimes with sandbox.mode set to off, bypassing runtime confinement restrictions.
CVSS 7.7 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node