GHSA-g5cg-8x5w-7jpmCritical

OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

Published
April 2, 2026
Last Modified
April 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-41329 →

📋 Description

Summary

Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

Current Maintainer Triage

  • Status: open
  • Normalized severity: Critical

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published npm version: 2026.3.31
  • Vulnerable version range: <=2026.3.28
  • Patched versions: >= 2026.3.31
  • First stable tag containing the fix: v2026.3.31

Fix Commit(s)

  • a30214a624946fc5c85c9558a27c1580172374fd — 2026-03-31T09:06:51+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

🎯 Affected products1

  • npm/openclaw:<= 2026.3.28

🔗 References (4)