CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback
Attackers can bypass sandbox restrictions in OpenClaw to invoke denied tools, accessing restricted data or performing unauthorized actions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100573?
CVE-2026-100573 is a medium-severity vulnerability in OpenClaw, published on 26 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions the operator intended to exclude from the sandbox.
Weakness: CWE-862
Which versions are affected by CVE-2026-100573?
How do I fix CVE-2026-100573?
Upgrade to a fixed version.
Is CVE-2026-100573 being exploited?
There is no known exploitation of CVE-2026-100573 in the wild and no public exploit code.
Sources
Also known as GHSA-5m4g-88rg-69pj, GHSA-v9f5-4mfv-5533, MINI-9h8j-9v4w-qrh7.