OpenClaw's Exec Sandbox Disaster and the CVE That Won't Go Away

Bug

OpenClaw 2026.4.1 Silently Broke Exec for All Existing Single-Operator Setups

The 2026.4.1 update auto-enabled Docker sandboxing and a new exec approval layer with zero migration guide, killing all cron exec jobs and agent commands overnight. The fix requires manually destroying sandbox containers, editing an undocumented config file, and hunting through multiple GitHub issues just to get back to baseline.

Security

CVE-2026-32922: 9.9 CVSS Privilege Escalation Still Haunting OpenClaw Deployments

A token rotation flaw lets any caller with the lowest-privilege pairing scope mint a full admin token, giving attackers RCE across all connected nodes in one API call. The patch shipped in 2026.3.11 but with 63% of the 135K internet-facing instances running without auth, most operators are still exposed.

Certik Study: OpenClaw Has 100+ CVEs, Malware-Laced Extensions, and Prompt Injection Risks

Certik's March 31 report frames OpenClaw as a platform that was built for trusted local environments but is now deployed at internet scale without the security architecture to match. The combo of malicious skills extensions, prompt injection via processed documents, and 135K exposed instances is a genuinely bad threat surface.

Analysis

500K OpenClaw Instances in the Wild With No Enterprise Kill Switch

At 500K deployments, the absence of a centralized kill switch stops being a philosophical concern and becomes an active incident response problem. If a critical zero-day drops, there is no fast path to contain it across managed environments.