CVE-2026-32048
EPSS 0.02%OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns
發布日:2026/3/2修改日:2026/3/27
描述
### Summary A sandboxed session could use cross-agent `sessions_spawn` to create a child under an agent configured with `sandbox.mode="off"`, downgrading runtime confinement. ### Impact In mixed-agent setups that allow cross-agent spawning, a sandboxed requester could escape into an unsandboxed child runtime. ### Fix Spawn-time sandbox inheritance is now enforced: if the requester is sandboxed and the resolved child runtime would be unsandboxed, spawn is rejected. ### Affected and Patched Versions - Affected: `<= 2026.2.26` - Patched: `2026.3.1`
受影響套件(1)
- npm/openclawfrom 0, < 2026.3.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |