Nixpkgs security tracker

Login with GitHub

Suggestion detail

Dismissed
Permalink CVE-2026-32048
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 1 month ago by @mweinelt Activity log
  • Created suggestion 1 month, 1 week ago
  • @mweinelt dismissed 1 month ago
OpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn

OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit this to spawn child runtimes with sandbox.mode set to off, bypassing runtime confinement restrictions.

Affected products

OpenClaw
  • ==2026.3.1
  • <2026.3.1

Matching in nixpkgs

Package maintainers

Fixed in https://github.com/nixos/nixpkgs/pull/499141