CVE-2026-41329Disclosure(openclaw / openclaw)

MEDIUMCVSS 9.0 · CRITICAL

Exploitation observed; activity peaked at 8 mentions and remains active

Immediate actions

Patch openclaw openclaw systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation. Attackers can exploit improper context validation to bypass sandbox restrictions and achieve unauthorized privilege escalation.

openclaw CVEs Back to dashboard

5.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/openclaw/openclaw/commit/a30214a624946fc5c85c9558a27c1580172374fd

Vendor / third-party advisories

Weakness type (CWE)

CWE-648

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openclaw

Threat summary

Active exploitation appears in 2 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
11 mentions across 3 observed days

What's happening

Active exploitation reported across 2 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 10 signals
Disclosure: 6 classified signals
General: 2 classified signals
Peaked 1d ago at 8 mentions (2026-04-21); latest day: 2
11 total mentions across 3 days

Affected systems

Vendors

openclaw

Products

openclaw

Deep dive

Activity timeline11 mentions / 3d

Signal classification4 categories

Disclosure

654.5%

General

218.2%

Patch

218.2%

Active Exploitation

19.1%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-20	1	Disclosure1
2026-04-21	8	Disclosure5General1Patch2
2026-04-22	2	Active Exploitation1General1

Full discourse11 posts

إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi173d
Disclosure
🚨 ثغرة خطيرة في OpenClaw. ⚠️رقم الثغرة: CVE-2026-41329 | التقييم: 9.9 (Critical). ⚠️ الثغرة تسمح للمهاجم بتجاوز (Sandbox) ومن ثم رفع صلاحياته. ⚠️الإصدارات المتأثرة: جميع إصدارات (OpenClaw) ما قبل الإصدار (2026.3.31) مصابة بالثغرة. ⚠️الثغره مكتشفه من 20 يوم ولكن تم الاعلان عنها بشكل رسمي اليوم عرفتو ليش السايبر يرفضون تركيب OpenClaw في اجهزه الدوام ! 😀
Post summary
The post discloses a critical CVE-2026-41329 affecting OpenClaw, detailing sandbox escape and privilege escalation; no PoC, exploit code, active use, or patch information is provided.
15131178.2K
49.3K followersView on X
Upwind Security MDR@UpwindMDR173d
Disclosure
⚠️ CVE-2026-41329 (9.9) in OpenClaw Attackers can escape sandbox restrictions and escalate privileges All versions prior to 2026.3.31 are impacted Recently disclosed - high risk for exploitation Update ASAP.
Post summary
CVE-2026-41329 is a high‑risk vulnerability in OpenClaw that allows sandbox escape and privilege escalation; all versions before 2026.3.31 are vulnerable and should be patched immediately.
00050561
237 followersView on X
CCB Alert@CCBalert172d
Patch
Warning: Critical Sandbox Bypass in #OpenClaw. #CVE-2026-41329 CVSS: 9.9. This vulnerability can lead to full privilege escalation via heartbeat context inheritance! https://ccb.belgium.be/advisories/warning-privilege-escalation-openclaw-patch-immediately #Patch #Patch #Patch
Post summary
The post announces a critical CVE-2026-41329 in OpenClaw, noting a CVSS score of 9.9 and providing a link to patch instructions, urging immediate remediation.
02020228
7.2K followersView on X
subagentic.ai@subagentic172d
Disclosure
New on http://subagentic.ai: Critical CVE-2026-41329 sandbox bypass hits OpenClaw with CVSS 9.9, GitHub freezes new Copilot sign-ups as agentic AI breaks flat-rate economics, and VS Code ships a standalone AI-first editor. https://subagentic.ai
Post summary
Subagentic.ai announces the new critical CVE-2026-41329 sandbox bypass affecting OpenClaw with a CVSS of 9.9.
2001097
8 followersView on X
CTIWatch@ctiwatchcloud173d
General
🔍 Today's Top Vulnerabilities 🔴 CVE-2026-41329 | CVSS 9.9 🔴 CVE-2026-30269 | CVSS 9.9 🔴 CVE-2026-32604 | CVSS 9.9 🔗 http://ctiwatch.cloud/vulnerabilities #CVE #Vulnerability #ThreatIntel
Post summary
The post lists three high‑CVSS CVEs and provides a link to a vulnerability page, but lacks detailed technical, exploit, or mitigation information.
0001058
5.6K followersView on X
Orizon@OrizonCyber173d
Patch
🚨 CVE-2026-41329 — CVSS 9.9/10 ██████████ OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/ZbcyXId31D
Post summary
CVE-2026-41329 is a critical sandbox bypass vulnerability in OpenClaw with a high severity rating, and a vendor patch is now available.
1000044
28 followersView on X
0day Signal@0dayPublishing173d
Disclosure
🚨 CVE-2026-41329: OpenClaw < 2026.3.31 - Sandbox B... Heartbeat context poisoning + senderIsOwner manipulation = full sandbox escape with CVSS 9.0 - classic privilege escala... https://zerodaysignal.com/vulnerability/CVE-2026-41329 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE-2026-41329, provides a link to a vulnerability detail page, and succinctly describes the vulnerability type and severity.
0100083
218 followersView on X
くりとグラの聴くサイバー防衛ラジオ@KuriGCyberRadio171d
General
https://youtu.be/zM2G_zBSACc OpenClawの重大なサンドボックスバイパス脆弱性 (CVE-2026-41329) Apache ActiveMQの悪用されている脆弱性 NGate Androidマルウェア　HandyPay NFCアプリを利用したカードデータ盗難について
Post summary
The snippet points to a YouTube video discussing a sandbox bypass in OpenClaw (CVE-2026-41329) and notes that an Apache ActiveMQ vulnerability is actively exploited, but it provides no detailed technical data or remediation advice.
00000127
2 followersView on X
klawlikula@klawlikula172d
Active Exploitation
⚠️ CRITICAL OpenClaw Security Alerts! 🚨 CVE-2026-41329 (CVSS 9.8): Sandbox bypass via heartbeat context inheritance. Actively exploited! Update to 2026.3.31+ immediately. CVE-2026-41294 (CVSS 8.6): Env var injection via .env files. Update to 2026.3.28+. Stay safe! 🐉
Post summary
This alert highlights two critical OpenClaw vulnerabilities, one of which is reported to be actively exploited in the wild, and urges users to apply the listed patch updates immediately.
0000057
3 followersView on X
CVE@CVEnew173d
Disclosure
CVE-2026-41329 OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parame… https://www.cve.org/CVERecord?id=CVE-2026-41329
Post summary
The text announces CVE-2026-41329, describing a sandbox bypass that allows privilege escalation in OpenClaw; it includes technical details but no PoC, exploit, or patch information.
0000091
57.2K followersView on X
PulsePatch.io@pulsepatchio173d
Disclosure
A critical sandbox bypass (CVE-2026-41329) affects `OpenClaw` via heartbeat context inheritance and `senderIsOwner` escalation. Investigate potential impact on isolated environments. #OpenClaw #Security #Vulnerability https://www.pulsepatch.io/posts/cve-2026-41329-openclaw-sandbox-bypass
Post summary
The post announces CVE‑2026‑41329 as a sandbox bypass in OpenClaw, noting its exploit mechanisms but providing no PoC, exploitation details, or patch information.
0000055
12 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openclaw	openclaw	-	node.js	-

Explore more

Back to dashboard openclaw CVEs openclaw vulnerabilities

What researchers are saying

CVE-2026-41329

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediDisclosure

The post discloses a critical CVE-2026-41329 affecting OpenClaw, detailing sandbox escape and privilege escalation; no PoC, exploit code, active use, or patch information is provided.

Upwind Security MDR[verified]@UpwindMDRDisclosure

CVE-2026-41329 is a high‑risk vulnerability in OpenClaw that allows sandbox escape and privilege escalation; all versions before 2026.3.31 are vulnerable and should be patched immediately.

Orizon[verified]@OrizonCyberPatch

CVE-2026-41329 is a critical sandbox bypass vulnerability in OpenClaw with a high severity rating, and a vendor patch is now available.

CCB Alert@CCBalertPatch

The post announces a critical CVE-2026-41329 in OpenClaw, noting a CVSS score of 9.9 and providing a link to patch instructions, urging immediate remediation.

subagentic.ai@subagenticDisclosure

Subagentic.ai announces the new critical CVE-2026-41329 sandbox bypass affecting OpenClaw with a CVSS of 9.9.

CTIWatch@ctiwatchcloudGeneral

The post lists three high‑CVSS CVEs and provides a link to a vulnerability page, but lacks detailed technical, exploit, or mitigation information.

0day Signal@0dayPublishingDisclosure

The post announces CVE-2026-41329, provides a link to a vulnerability detail page, and succinctly describes the vulnerability type and severity.

くりとグラの聴くサイバー防衛ラジオ@KuriGCyberRadioGeneral

The snippet points to a YouTube video discussing a sandbox bypass in OpenClaw (CVE-2026-41329) and notes that an Apache ActiveMQ vulnerability is actively exploited, but it provides no detailed technical data or remediation advice.