CVE-2026-33573: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-33573 is an authorization bypass vulnerability in OpenClaw's gateway agent RPC that allows authenticated operators with operator.write permission to escape configured workspace boundaries by supplying attacker-controlled spawnedBy and workspaceDir parameter values. It affects OpenClaw versions up to and including 2026.3.8 (npm package), with the fix delivered in version 2026.3.11. The vulnerability was published on March 29, 2026, and was assigned a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-668 (Exposure of Resource to Wrong Sphere): the public gateway agent RPC endpoint fails to enforce the server-configured workspace boundary, instead trusting caller-supplied spawnedBy and workspaceDir values without validation (GitHub Advisory). An attacker with a valid account holding operator.write permission can craft an RPC call that re-roots the agent run to an arbitrary directory accessible by the OpenClaw process, effectively performing a path traversal/boundary escape at the RPC layer. No user interaction is required, and the attack is conducted over the network with low complexity. The fix in version 2026.3.11 enforces the configured workspace boundary server-side, ignoring any caller-supplied overrides (GitHub Advisory).

Successful exploitation allows a non-owner operator to escape the intended workspace sandbox and perform arbitrary file read/write and command execution operations from any directory accessible to the OpenClaw process. This results in high impact to confidentiality (unauthorized access to sensitive files outside the workspace), integrity (modification of system or application files), and availability (potential disruption via arbitrary exec operations). While the vulnerability does not directly affect subsequent/downstream systems per the CVSS v4 assessment, lateral movement within the host environment is feasible depending on the privileges of the OpenClaw process (GitHub Advisory, Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042–0.067%, placing it in the 21st percentile for exploitation likelihood within 30 days. Exploitation requires authenticated access with operator.write privileges, which limits the attack surface compared to unauthenticated vulnerabilities (Github Advisory).

1. Reconnaissance: Identify OpenClaw deployments running versions ≤ 2026.3.8 (npm). Confirm the target exposes the gateway agent RPC endpoint over the network.
2. Obtain credentials: Acquire or compromise an account with operator.write permission on the target OpenClaw instance (e.g., via credential theft, phishing, or abuse of a legitimately provisioned operator account).
3. Craft malicious RPC call: Authenticate to the gateway agent RPC and issue an agent invocation request, supplying attacker-controlled values for the spawnedBy and workspaceDir parameters — for example, setting workspaceDir to an arbitrary path such as /etc or the application root outside the intended workspace.
4. Escape workspace boundary: Because the server does not validate or override these caller-supplied values, the agent run is re-rooted to the attacker-specified directory, bypassing the configured workspace boundary.
5. Execute arbitrary operations: Use the agent's file and exec tool capabilities to read sensitive files (e.g., credentials, configuration), write malicious files, or execute arbitrary commands with the privileges of the OpenClaw process (GitHub Advisory).

• Network: Authenticated RPC requests to the OpenClaw gateway agent endpoint containing unusual or absolute-path values in workspaceDir parameters (e.g., paths outside the expected workspace root such as /etc, /var, /home, or application config directories).
• Logs: OpenClaw agent execution logs showing file or exec operations originating from directories outside the configured workspace boundary; repeated agent invocations with varying workspaceDir values from the same operator account.
• Process: Child processes spawned by the OpenClaw process accessing files or directories outside the expected workspace (e.g., reading /etc/passwd, /etc/shadow, or application secrets); unexpected exec operations initiated by the OpenClaw service account.
• File System: New or modified files in sensitive directories (outside the workspace) attributable to the OpenClaw process owner; unexpected scripts or binaries written to system directories.

Upgrade OpenClaw to version 2026.3.11 or later (also included in 2026.3.12 and subsequent releases), which enforces the configured workspace boundary server-side regardless of caller-supplied spawnedBy or workspaceDir values (GitHub Advisory). As interim mitigations, audit and restrict operator.write permission assignments to only fully trusted administrators, implement network segmentation to limit access to the gateway agent RPC endpoint, and enable enhanced logging for all agent RPC invocations to detect anomalous workspaceDir values. Organizations unable to patch immediately should consider disabling the gateway agent RPC if not operationally required.

The vulnerability was reported by researcher tdjackey and disclosed by maintainer steipete via the GitHub Security Advisory (GitHub Advisory). Coverage appeared on The Hacker Wire shortly after disclosure, and the CVE was noted across automated security feeds including CVEFeed, VulnDB, and Bluesky CVE tracking accounts. Community reaction has been limited given the requirement for authenticated access, though the workspace escape primitive has been noted as a meaningful privilege escalation risk for multi-operator deployments.