Iniciar sesión
Deutsch English Español Polski
Alta

OpenClaw: Sandboxed agents could escape exec routing via host=node override

  • Publicada: 17.04.2026
  • Actualizado: 11.10.2026 10:22

Summary

Sandboxed agents could escape exec routing via host=node override.

Affected Packages / Versions

  • Package: openclaw
  • Ecosystem: npm
  • Affected versions: >= 2026.4.5 < 2026.4.10
  • Patched versions: >= 2026.4.10

Impact

A sandboxed agent could request host: "node" and route exec to a remote node instead of the intended sandbox execution path, bypassing the sandbox routing boundary.

Technical Details

The fix blocks sandboxed exec escape to remote node targets and keeps routing aligned with the active sandbox policy.

Fix

The issue was fixed in #63880. The first stable tag containing the fix is v2026.4.10, and openclaw@2026.4.14 includes the fix.

Fix Commit(s)

  • dffad08529202edbf34e4808788e1182fe10f6a9
  • PR: #63880

Release Process Note

Users should upgrade to openclaw 2026.4.10 or newer. The latest npm release, 2026.4.14, already includes the fix.

Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de npm openclaw >= 2026.4.5, < 2026.4.10 2026.4.10

Referencias

Puntuación CVSS 8.8/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Debilidad (CWE)
CWE-863
Plataforma
npm
Paquete
openclaw
Publicada
17.04.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-736r-jwj6-4w23 - CC BY 4.0

Historial de vulnerabilidades: openclaw

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (589) en el archivo
Entradas en total
589
Primera → última
02.2026 10.2026
Sin corrección
9
Explotada en ataques
0

Distribución por gravedad

  • Crítica 20
  • Alta 215
  • Media 300
  • Baja 54

Divulgaciones por año

Gravedad:
  1. OpenClaw: Native command authorization could skip owner-command enforcement
    Alta CVE-2026-53828 < 2026.5.6 2026.5.6
  2. OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
    Alta · 8.8 CVE-2026-53836 < 2026.5.12 2026.5.12
  3. OpenClaw: Trusted retry endpoint checks could match hostname prefixes
    Alta CVE-2026-53839 < 2026.5.7 2026.5.7
  4. OpenClaw: Telegram interactive callbacks could skip commands.allowFrom
    Alta CVE-2026-53807 < 2026.5.6 2026.5.6
  5. OpenClaw: Matrix allowFrom could bind to mutable display names
    Alta · 8.8 CVE-2026-53811 < 2026.5.7 2026.5.7
  6. OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
    Alta · 7.2 CVE-2026-53816 < 2026.5.18 2026.5.18
  7. OpenClaw: Combined POSIX shell options could confuse exec revalidation
    Alta · 8.8 CVE-2026-53806 < 2026.5.12 2026.5.12
  8. OpenClaw: Fake package roots could influence memory-core artifact loading
    Alta · 7.8 CVE-2026-53813 < 2026.4.25 2026.4.25
  9. OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
    Alta · 8.8 CVE-2026-53819 < 2026.5.27 2026.5.27
  10. OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
    Alta · 7.5 CVE-2026-53834 < 2026.4.27 2026.4.27
  11. OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
    Alta · 8.3 CVE-2026-32905 < 2026.5.4 2026.5.4
  12. OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
    Crítica CVE-2026-34507 < 2026.4.29 2026.4.29
  13. OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
    Alta · 8.8 CVE-2026-53821 < 2026.5.18 2026.5.18
  14. OpenClaw: Slack allowFrom could bind to mutable display names
    Alta CVE-2026-53823 < 2026.5.3 2026.5.3
  15. OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
    Alta · 7.7 CVE-2026-53833 < 2026.4.29 2026.4.29
  16. OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
    Alta · 8.8 CVE-2026-35674 < 2026.5.18 2026.5.18
  17. OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
    Alta · 7.1 CVE-2026-53831 < 2026.5.18 2026.5.18
  18. OpenClaw: QQBot native approval buttons did not enforce configured approver identity
    Alta · 8.0 CVE-2026-35630 < 2026.5.18 2026.5.18
  19. OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
    Alta · 8.4 CVE-2026-53814 < 2026.5.20 2026.5.20
  20. OpenClaw: Control UI locality spoofing could mint a durable admin device token
    Alta · 8.0 CVE-2026-53817 < 2026.5.22 2026.5.22
  21. OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
    Alta · 7.7 CVE-2026-53832 < 2026.5.18 2026.5.18
  22. OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
    Alta · 8.8 CVE-2026-53810 < 2026.5.18 2026.5.18
  23. OpenClaw: Shell wrapper argv could change between approval and execution
    Alta CVE-2026-53822 < 2026.5.18 2026.5.18
  24. OpenClaw: Exec approval display truncation could hide the command being approved
    Alta · 8.0 CVE-2026-53829 < 2026.5.18 2026.5.18
  25. OpenClaw: Message read actions could skip channel allowlist checks
    Alta · 6.5 CVE-2026-53815 < 2026.5.19 2026.5.19
  26. OpenClaw: Workspace-derived service PATH could influence trash command selection
    Alta · 7.1 CVE-2026-53865 < 2026.5.2 2026.5.2
  27. OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots
    Alta · 7.1 CVE-2026-53858 < 2026.5.2 2026.5.2
  28. OpenClaw: Discord allowFrom could bind to mutable display names
    Alta · 8.1 CVE-2026-53849 < 2026.5.7 2026.5.7
  29. OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install
    Alta · 7.1 CVE-2026-53846 < 2026.4.29 2026.4.29
  30. OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
    Alta · 7.1 CVE-2026-53853 < 2026.5.12 2026.5.12
  31. OpenClaw: Zalo allowFrom could bind to mutable display names
    Alta · 8.1 CVE-2026-53857 < 2026.5.3 2026.5.3
  32. OpenClaw: Shell positional parameters could weaken strict inline-eval checks
    Alta · 8.1 CVE-2026-53855 < 2026.4.2 2026.4.2
  33. OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
    Alta · 7.1 CVE-2026-53842 < 2026.5.2 2026.5.2
  34. OpenClaw: Shell inline-command parsing could miss an allowlist check
    Alta · 8.1 CVE-2026-53866 < 2026.5.12 2026.5.12
  35. OpenClaw: Pairing-scoped device session could restore revoked node token authority
    Alta · 8.8 CVE-2026-53843 < 2026.5.26 2026.5.26
  36. OpenClaw: Host environment sanitizer missed two Node.js control variables
    Alta · 8.1 CVE-2026-53864 < 2026.5.26 2026.5.26
  37. OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
    Alta · 7.1 CVE-2026-53840 < 2026.5.12 2026.5.12
  38. OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
    Alta · 8.8 CVE-2026-45006 < 2026.4.23 2026.4.23
  39. OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
    Alta · 7.8 CVE-2026-45004 < 2026.4.23 2026.4.23
  40. OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
    Alta · 7.8 CVE-2026-44118 < 2026.4.22 2026.4.22
  41. OpenClaw: Workspace dotenv could override runtime-control environment variables
    Alta · 7.8 CVE-2026-44114 < 2026.4.20 2026.4.20
  42. OpenClaw: Feishu webhook and card-action validation now fail closed
    Crítica · 9.8 CVE-2026-44109 < 2026.4.15 2026.4.15
  43. OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
    Crítica · 8.1 CVE-2026-43585 < 2026.4.15 2026.4.15
  44. OpenClaw: QQBot media tags could read arbitrary local files through reply text
    Alta CVE-2026-43533 < 2026.4.10 2026.4.10
  45. OpenClaw: busybox and toybox applet execution weakened exec approval binding
    Alta · 8.8 CVE-2026-43530 >= 2026.2.23, < 2026.4.12 2026.4.12
  46. OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
    Alta · 6.5 CVE-2026-42433 < 2026.4.10 2026.4.10
  47. OpenClaw: Sandboxed agents could escape exec routing via host=node override esta entrada
    Alta · 8.8 CVE-2026-42434 >= 2026.4.5, < 2026.4.10 2026.4.10
  48. OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
    Alta · 8.8 CVE-2026-43569 < 2026.4.9 2026.4.9
  49. OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
    Alta CVE-2026-43581 < 2026.4.10 2026.4.10
  50. OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
    Alta · 8.8 CVE-2026-43571 < 2026.4.10 2026.4.10
  51. OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
    Alta · 8.8 CVE-2026-43584 < 2026.4.10 2026.4.10
  52. OpenClaw: Voice-call realtime WebSocket accepted oversized frames
    Alta · 7.5 CVE-2026-42437 >= 2026.4.9, < 2026.4.10 2026.4.10
  53. OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
    Alta CVE-2026-43528 < 2026.4.14 2026.4.14
  54. OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects
    Alta CVE-2026-40037 < 2026.4.8 2026.4.8
  55. OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
    Alta · 7.8 CVE-2026-42432 < 2026.4.8 2026.4.8
  56. OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
    Alta CVE-2026-42427 < 2026.4.8 2026.4.8
  57. OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
    Alta ghsa-jf56-mccx-5f3f < 2026.4.8 2026.4.8
  58. OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
    Alta ghsa-gfmx-pph7-g46x < 2026.4.8 2026.4.8
  59. OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
    Alta · 7.1 CVE-2026-41359 < 2026.3.28 2026.3.28
  60. OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
    Alta · 7.8 CVE-2026-41384 < 2026.3.24 2026.3.24
  61. OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
    Alta CVE-2026-34511 < 2026.4.2 2026.4.2
  62. OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
    Alta CVE-2026-41393 < 2026.3.31 2026.3.31
  63. OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
    Alta · 9.8 CVE-2026-41386 < 2026.3.22 2026.3.22
  64. OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
    Alta CVE-2026-41353 < 2026.3.22 2026.3.22
  65. OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
    Alta · 8.8 CVE-2026-41378 < 2026.3.31 2026.3.31
  66. OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
    Crítica · 8.2 CVE-2026-41296 < 2026.3.31 2026.3.31
  67. OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
    Alta · 6.5 CVE-2026-41369 < 2026.3.31 2026.3.31
  68. OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
    Alta CVE-2026-41404 < 2026.3.31 2026.3.31
  69. OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
    Alta CVE-2026-41349 < 2026.3.28 2026.3.28
  70. OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
    Alta · 6.1 CVE-2026-41373 < 2026.3.31 2026.3.31
  71. OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
    Alta · 8.8 CVE-2026-41352 < 2026.3.31 2026.3.31
  72. OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
    Alta · 7.5 CVE-2026-41405 < 2026.3.31 2026.3.31
  73. OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
    Alta CVE-2026-41366 < 2026.3.31 2026.3.31
  74. OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
    Alta · 9.6 CVE-2026-41397 < 2026.3.31 2026.3.31
  75. OpenClaw: Workspace `.env` can override the bundled plugin trust root
    Alta · 7.8 CVE-2026-41396 < 2026.3.31 2026.3.31
  76. OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host
    Alta · 8.1 CVE-2026-41364 < 2026.3.31 2026.3.31
  77. OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code
    Alta · 7.8 CVE-2026-41336 < 2026.3.31 2026.3.31
  78. OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation
    Crítica CVE-2026-41329 < 2026.3.31 2026.3.31
  79. OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic
    Alta · 5.3 CVE-2026-41391 < 2026.3.31 2026.3.31
  80. OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover
    Crítica · 9.6 CVE-2026-41294 < 2026.3.28 2026.3.28
Mostrar más (20) Mostrando 80 de 235

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.