CVE-2026-42434: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-42434 is a sandbox escape vulnerability in OpenClaw (npm package) affecting versions 2026.4.5 through 2026.4.9, where sandboxed agents can override exec routing by specifying host=node, bypassing intended sandbox execution boundaries. The vulnerability was disclosed on May 5, 2026, with the underlying fix committed on April 16, 2026 (PR #63880). It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, VulnCheck). The CVE was assigned by VulnCheck and reported by researcher @zsxsoft with sponsorship from @KeenSecurityLab and @qclawer (GitHub Advisory).

The root cause is an incorrect authorization flaw (CWE-863) in OpenClaw's exec routing logic. When a sandbox runtime is active and tools.exec.host is set to auto, the isRequestedExecTargetAllowed and canExecRequestNode functions failed to block per-call overrides specifying host=node or host=gateway, allowing sandboxed agents to route execution to remote nodes outside the sandbox boundary. The fix in commit dffad08 explicitly checks for sandbox availability and rejects host=node or host=gateway override requests when a sandbox runtime is active, and also stops advertising node routing capability in that state (GitHub Commit, GitHub Advisory). Exploitation requires low privileges (a sandboxed agent context) and no user interaction, and is network-accessible.

Successful exploitation allows a low-privileged sandboxed agent to escape its execution boundary and route commands to remote nodes, effectively bypassing the sandbox policy entirely. This can result in unauthorized access to confidential information, unauthorized modification of system integrity, and disruption of system availability on remote nodes. The vulnerability also enables potential lateral movement and privilege escalation within the broader infrastructure, as the attacker gains execution capabilities beyond the intended sandbox scope (GitHub Advisory, VulnCheck).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.051%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate an OpenClaw deployment running npm package versions 2026.4.5–2026.4.9 with sandbox mode enabled (tools.exec.host=auto) and at least one sandboxed agent accessible to the attacker.
2. Obtain sandboxed agent access: Authenticate or operate as a low-privileged sandboxed agent within the OpenClaw environment — no elevated privileges are required.
3. Craft malicious exec request: Issue an exec call from within the sandboxed agent context, explicitly specifying host: "node" (or host: "gateway") as a per-call parameter to override the sandbox routing policy.
4. Bypass sandbox boundary: Because the vulnerable versions of isRequestedExecTargetAllowed do not check sandbox availability when evaluating host=node overrides, the request is permitted and execution is routed to the remote node instead of the sandbox host.
5. Execute on remote node: Commands are now executed on the remote node outside the sandbox, enabling data access, system modification, or further lateral movement within the infrastructure (GitHub Advisory, GitHub Commit).

• Logs: OpenClaw agent logs showing exec requests with host=node or host=gateway parameters originating from sessions where tools.exec.host=auto and a sandbox runtime is active; unexpected exec routing to remote nodes in agent session logs.
• Network: Unusual outbound connections from sandbox environments to remote node addresses not consistent with normal sandbox-confined traffic patterns.
• Process/Behavior: Exec commands executing on remote nodes rather than the expected sandbox host; agent sessions exhibiting elevated capabilities inconsistent with their configured sandbox policy.

Upgrade OpenClaw to version 2026.4.10 or later (the latest npm release, 2026.4.14, also includes the fix) to resolve this vulnerability (GitHub Advisory). As interim mitigations, implement network segmentation to restrict communication between sandbox environments and remote nodes, restrict privileges for agents that can modify routing parameters, and monitor for suspicious host parameter specifications in agent exec calls. Consider temporarily disabling or isolating affected OpenClaw instances until patching is completed (Feedly).

The vulnerability was reported by @zsxsoft with sponsorship from @KeenSecurityLab and @qclawer, indicating coordinated security research involvement (GitHub Advisory). A Mastodon post from @thehackerwire noted the disclosure shortly after publication. Coverage from flyingpenguin.com referenced the broader context of CVE patching in OpenClaw, noting the challenges of agent-assisted vulnerability remediation (Feedly).