CVE-2026-100573 in OpenClawinfo

Summary

by MITRE • 09/26/2026

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions the operator intended to exclude from the sandbox.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

VulnCheck

Reservation

09/26/2026

Disclosure

09/26/2026

Moderation

accepted

CPE

ready

EPSS

0.00000

KEV

no

Activities

very low

Sector

Government, Insurance, ...

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-100573
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-100573
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-100573/

◂ PreviousOverviewNext ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!