MEDIUM 4.8 NVD
CVE-2026-100573
OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to inv
OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions the operator intended to exclude from the sandbox.
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-5m4g-88rg-69pj
- https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-sandbox-policy-bypass-via-mc
This medium severity vulnerability with a CVSS score of 4.8 was published on 2026-09-26 via NVD.
vulnfeed aggregates 11591 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.