Four OpenClaw Flaws Enable Attackers to Exploit Agent’s Sandbox
May 16, 2026 – 10:15 am
Image by: Canva
TL;DR:
Four interconnected vulnerabilities in OpenClaw, collectively known as “Claw Chain,” allow attackers to steal data, escalate privileges, and install backdoors within the agent’s sandbox environment. Patches are available in OpenClaw version 2026.4.22.
Cybersecurity researchers at Cyera have disclosed these vulnerabilities:
- CVE-2026-44113 and CVE-2026-44115: These flaws enable unauthorized access to credentials, secrets, and sensitive files within the sandbox.
- CVE-2026-44118: This vulnerability allows attackers to gain owner-level control of the agent runtime by exploiting a misvalidated ownership flag, enabling them to modify configuration and establish persistence outside the sandbox.
- CVE-2026-44112: The most severe (CVSS score: 9.6) of the four, this flaw allows attackers to install backdoors, modify configurations, and achieve persistent access beyond the sandbox’s intended scope.
Key Takeaways:
- Normal Behavior Camouflage: Claw Chain is particularly concerning because each step appears as normal agent behavior to traditional security controls, making detection difficult.
- Widespread Impact: The attack vector leverages an agent’s privileges, expanding its reach and posing a broader threat to the system it operates within.
- Patch Availability: OpenClaw has released patches addressing these vulnerabilities in version 2026.4.22.
Previous Security Concerns:
This isn’t the first time OpenClaw’s security has been questioned. In January, a critical remote code execution vulnerability (CVE-2026-25253) allowed any website visited by a user to connect silently to the agent’s local server.