CVE-2026-27646: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-27646 is a sandbox escape vulnerability in OpenClaw (npm package) affecting all versions prior to 2026.3.7. The flaw allows authorized users within sandboxed sessions to invoke the /acp spawn slash-command to bypass sandbox restrictions and initialize host-side ACP (Authorized Command Processing) runtime. It was published on March 23, 2026, and assigned by VulnCheck. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) per Feedly/NVD data, while the GitHub Security Advisory rates it as Moderate (5.9 CVSS v3.1) (GitHub Advisory).

The root cause is an incorrect authorization check (CWE-863) — specifically, a policy gap between two code paths for spawning ACP sessions. The direct ACP spawn path in src/agents/acp-spawn.ts correctly denied sandboxed requesters via a host-runtime guard, but the /acp spawn slash-command handler in src/auto-reply/reply/commands-acp/lifecycle.ts called initializeSession() without first applying the same guard, allowing the restriction to be bypassed (GitHub Advisory, Fix Commit). Exploitation requires the attacker to already be an authorized sender within a sandboxed session, and ACP must be enabled with a backend available. The attack vector is local (low complexity, low privileges required, no user interaction needed) (GitHub Advisory).

A successful exploit allows an authorized sandboxed session user to escape sandbox confinement and gain access to host-side ACP runtime initialization, effectively elevating their privilege level beyond what the sandbox is intended to permit. The primary impact is high integrity compromise — an attacker can execute commands at the host level — with a low confidentiality impact due to potential access to host-side session data. Availability is not impacted. The scope is limited to the host running OpenClaw when ACP is enabled (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0001 (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to already hold authorized access within a sandboxed OpenClaw session, significantly limiting the attack surface (GitHub Advisory).

1. Gain authorized sandboxed session access: Obtain credentials or authorization to interact as a sender within an OpenClaw sandboxed session (e.g., via a Discord bot integration configured with sandbox: { mode: "all" }).
2. Confirm ACP is enabled: Verify that the target OpenClaw deployment has ACP enabled (acp.enabled=true) and a backend is available, as the vulnerability is only exploitable under these conditions.
3. Invoke the vulnerable slash-command: From within the sandboxed chat context, send the /acp spawn <agentId> slash-command (e.g., /acp spawn codex).
4. Bypass sandbox restriction: In unpatched versions (≤ 2026.3.2), the /acp spawn handler in lifecycle.ts calls initializeSession() without applying the host-runtime guard, allowing the sandboxed session to cross into host-side ACP runtime initialization.
5. Achieve host-level ACP session: The attacker's session is now initialized as a host-side ACP session, granting elevated command execution capabilities outside the sandbox boundary (GitHub Advisory, Fix Commit).

• Logs: Unexpected /acp spawn slash-command invocations originating from sessions configured with sandbox mode (sandbox: { mode: "all" } or similar); absence of the expected error message "Sandboxed sessions cannot spawn ACP sessions" in logs for sandboxed session spawn attempts on unpatched versions.
• Application Behavior: ACP sessions being initialized or appearing active when the originating requester session is known to be sandboxed; ACP backend connections established from sandboxed session contexts.
• File System: Review src/auto-reply/reply/commands-acp/lifecycle.ts for the presence of the resolveAcpSpawnRuntimePolicyError import — its absence indicates an unpatched version (Fix Commit).

Upgrade OpenClaw (npm package) to version 2026.3.7 or later, which introduces a shared resolveAcpSpawnRuntimePolicyError() guard reused by both the direct ACP spawn path and the /acp spawn slash-command handler (Fix Commit). As a temporary workaround if upgrading is not immediately possible: disable ACP functionality (acp.enabled=false) to eliminate the vulnerable code path, and restrict which users can execute slash-commands in sandboxed sessions. Monitor logs for unexpected /acp spawn invocations from sandboxed contexts (GitHub Advisory).

The vulnerability was reported by researcher @tdjackey and credited in the GitHub Security Advisory published by steipete on March 8, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory).