CVE-2026-32915: OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Subagent Control Surface
OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf worker can steer or kill sibling runs and cause execution with broader tool policies by exploiting insufficient authorization checks on subagent control requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.3.11
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32915?
CVE-2026-32915 is classified as a low severity vulnerability.
How do I fix CVE-2026-32915?
To fix CVE-2026-32915, upgrade to OpenClaw version 2026.3.11 or later.
What systems are affected by CVE-2026-32915?
CVE-2026-32915 affects OpenClaw versions prior to 2026.3.11.
What type of vulnerability is CVE-2026-32915?
CVE-2026-32915 is a sandbox boundary bypass vulnerability.
What impact does CVE-2026-32915 have on security?
CVE-2026-32915 allows leaf subagents to access restrictions meant for the parent requester scope.