cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Cyera Details Four OpenClaw Flaws That Can Enable Sandbox Escape and Backdoors

· Original article ↗

Summary

Cyera says four OpenClaw flaws, dubbed Claw Chain, can be chained from code execution inside the sandbox to access data, escalate privileges, and plant host backdoors. OpenClaw rolled out patches the day after disclosure.

Key points

  • Cyera says the Claw Chain involves four OpenClaw/OpenShell vulnerabilities and requires an attacker to first gain code execution inside the sandbox.
  • Prompt injections, malicious plugins, or compromised external input could provide a way to trigger the chain, according to Cyera.
  • CVE-2026-44113 can enable reads outside the mount root; CVE-2026-44115 can allow unapproved commands to run at runtime.
  • Cyera says the MCP loopback flaw CVE-2026-44118 can enable owner-level privileges by manipulating an unverified ownership flag.
  • CVE-2026-44112, rated CVSS 9.6, is a race condition that can allow writes outside the sandbox, including changes to configurations and planting backdoors.
  • Cyera reported the flaws to OpenClaw maintainers on April 22; patches were rolled out the next day. Cyera also reported more than 60,000 publicly accessible OpenClaw instances.

Article Details

Vulnerability Types
  • Race condition
  • Exec allowlist analysis flaw
  • MCP loopback ownership verification flaw
Severity
Critical for CVE-2026-44112 (CVSS 9.6); severity of the other vulnerabilities not stated
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1005 · Data from Local SystemThe described chain can read files outside the OpenShell sandbox mount root and expose sensitive data.T1068 · Exploitation for Privilege EscalationThe MCP loopback flaw can be exploited to elevate access to owner-level privileges.

CVE

CVE-2026-44112Finally, the attacker can exploit the fourth vulnerability, a critical-severity race condition in the OpenShell sandbox (CVE-2026-44112, CVSS score of 9.6), to write data outside the sandbox boundary.CVE-2026-44113After gaining code execution within the OpenShell sandbox, the attacker can exploit a race condition (CVE-2026-44113) to read files outside the mount root, or an exec allowlist analysis bug (CVE-2026-44115) to executeCVE-2026-44115condition (CVE-2026-44113) to read files outside the mount root, or an exec allowlist analysis bug (CVE-2026-44115) to execute unapproved commands at runtime.CVE-2026-44118Next, the attacker can exploit an MCP loopback flaw (CVE-2026-44118) to manipulate the unverified ownership flag and elevate their privileges to owner-level. The attacker gains access to critical management functions,

Products

OpenClawFour vulnerabilities in the OpenClaw AI assistant can be chained together to plant backdoors on the underlying host, cybersecurity firm Cyera warns.OpenShellAfter gaining code execution within the OpenShell sandbox, the attacker can exploit a race condition (CVE-2026-44113) to read files outside the mount root, or an exec allowlist analysis bug (CVE-2026-44115) to execute

Related Articles