CVE-2026-32048: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32048 is a sandbox escape vulnerability in OpenClaw (npm package) that allows a low-privileged attacker with a sandboxed session to bypass runtime confinement by spawning child processes under unsandboxed agents. The flaw affects OpenClaw versions prior to 2026.3.1 (specifically <= 2026.2.26) for Node.js environments. It was published on March 21, 2026, with a patch released in version 2026.3.1. The vulnerability carries a CVSS v3.1 base score of 9.9 (Critical) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource), with the GitHub advisory also citing CWE-269 (Improper Privilege Management) and CWE-284 (Improper Access Control). The vulnerability exists because OpenClaw fails to enforce sandbox inheritance during cross-agent sessions_spawn operations: when a sandboxed session initiates a spawn targeting an agent configured with sandbox.mode="off", the runtime does not validate or propagate the requester's sandbox constraints to the child process. This allows the child runtime to execute without any sandbox restrictions. The fix enforces spawn-time sandbox inheritance, rejecting spawns where a sandboxed requester would produce an unsandboxed child runtime (GitHub Advisory).

Successful exploitation allows an attacker with only a sandboxed session to escape runtime confinement entirely, spawning child processes with sandbox.mode set to off. In mixed-agent setups that permit cross-agent spawning, this results in high impact to confidentiality, integrity, and availability — the attacker gains unrestricted process execution capabilities that could enable data exfiltration, system compromise, and lateral movement across connected agent infrastructure (GitHub Advisory, VulnCheck).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires low privileges (an existing sandboxed session) and no user interaction, making it relatively straightforward to exploit if an attacker already has access to a sandboxed session in a vulnerable mixed-agent deployment. The EPSS score is approximately 0.039%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (VulnCheck, GitHub Advisory).

1. Gain sandboxed session access: Obtain or authenticate as a low-privileged user with a sandboxed session on a vulnerable OpenClaw deployment (version <= 2026.2.26).
2. Identify mixed-agent configuration: Confirm the target environment uses a mixed-agent setup where at least one agent is configured with sandbox.mode="off" and cross-agent spawning is permitted.
3. Initiate cross-agent sessions_spawn: From the sandboxed session, invoke the sessions_spawn API targeting the unsandboxed agent, exploiting the lack of sandbox inheritance enforcement.
4. Spawn unsandboxed child runtime: The child process is created under the unsandboxed agent with sandbox.mode effectively disabled, granting unrestricted execution capabilities.
5. Execute arbitrary operations: Use the unsandboxed child runtime to perform privileged operations, access sensitive data, or pivot to other systems within the agent infrastructure (GitHub Advisory, VulnCheck).

• Logs: Unexpected sessions_spawn calls originating from sandboxed session identifiers targeting agents with sandbox.mode="off"; audit log entries showing child runtime creation with sandbox restrictions absent.
• Process: Child processes spawned by OpenClaw agent processes that lack expected sandbox constraints or run with elevated permissions compared to their parent session context.
• Network: Unusual outbound connections or inter-agent communication patterns initiated from child runtimes that would not normally be permitted under sandbox confinement.
• Configuration: Runtime configuration records or logs showing sandbox.mode set to off for child processes whose parent sessions were sandboxed.

Upgrade OpenClaw to version 2026.3.1 or later, which enforces spawn-time sandbox inheritance and rejects any spawn where a sandboxed requester would produce an unsandboxed child runtime. No official configuration-based workaround is documented; however, as an interim measure, administrators can disable cross-agent spawning in mixed-agent environments or restrict agent configurations so no agent uses sandbox.mode="off" in deployments where sandboxed sessions exist. Refer to the security advisory for full remediation guidance (GitHub Advisory).

The OpenClaw vendor published a blog post in late March 2026 summarizing nine vulnerabilities disclosed over four days in March 2026, of which CVE-2026-32048 was one (OpenClaw Blog). A Medium article from the Israeli Tech Radar discussed the broader "ClawJacked" issue and the autonomous agent security problem in the context of these disclosures (Medium). Security aggregators including RedPacket Security and VulDB noted the CVE shortly after publication, and the vulnerability was picked up by automated CVE tracking feeds, but no major independent researcher commentary or widespread media coverage has been identified.