CVE-2026-32915 — OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf…

Key facts

CVE-2026-32915 is a High (8.8) vulnerability: OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

CVE	CVE-2026-32915
Severity	High (8.8)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-32915/

Details

CVE-2026-32915 is a High (8.8) vulnerability: OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf worker can steer or kill sibling runs and cause execution with broader tool policies by exploiting insufficient authorization checks on subagent control requests.

Vulnerability Details

Property	Value
CVE ID	CVE-2026-32915
CVSS Score	8.8

Proof of Concept

Download

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-32915/poc.py

Usage

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start

# Clone and navigate to CVE directory
cd CVE-2026-32915

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-4w7m-58cg-cmff
• https://www.vulncheck.com/advisories/openclaw-sandbox-boundary-bypass-via-subagent-control-surface

---

Generated by PoC Generator on 2026-04-10T15:46:25.665321248

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-32915, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2026-32915 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-32915 OpenClaw sandbox boundary bypass attempt"; flow:established,to_server; content:"subagent"; nocase; content:"control"; distance:0; within:100; content:"scope"; distance:0; within:200; pcre:"/(?:resolve|access|steer|kill).*(?:parent|sibling)/i"; classtype:policy-violation; sid:1000000; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32915 OpenClaw leaf worker privilege escalation"; flow:established,to_server; content:"leaf"; nocase; content:"worker"; distance:0; within:50; content:"subagent"; distance:0; within:100; pcre:"/(?:session.*tree|control.*surface)/i"; classtype:attempted-admin; sid:1000001; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32915 OpenClaw unauthorized subagent control request"; flow:established,to_server; content:"subagent"; nocase; content:"control"; distance:0; within:50; content:"request"; distance:0; within:100; pcre:"/(?:authorization|policy).*(?:bypass|escalat)/i"; classtype:policy-violation; sid:1000002; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32915 OpenClaw parent requester scope access"; flow:established,to_server; content:"parent"; nocase; content:"requester"; distance:0; within:50; content:"scope"; distance:0; within:100; content:"resolve"; distance:0; within:150; classtype:attempted-admin; sid:1000003; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32915 OpenClaw sibling run manipulation attempt"; flow:established,to_server; content:"sibling"; nocase; content:"run"; distance:0; within:50; pcre:"/(?:steer|kill|manipulat)/i"; content:"tool"; distance:0; within:200; content:"polic"; distance:0; within:50; classtype:attempted-dos; sid:1000004; rev:1; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_32915_OpenClaw_Sandbox_Bypass {
    meta:
        author = "Security Engineer"
        description = "Detects OpenClaw sandbox boundary bypass vulnerability exploitation"
        cve = "CVE-2026-32915"
        date = "2024"
        reference = "OpenClaw before 2026.3.11 sandbox bypass"
        severity = "high"

    strings:
        $openclaw_binary = "OpenClaw" nocase
        $version_pattern = /OpenClaw\s+(?:v)?(?:20(?:2[0-5]|1[0-9])|(?:0|1)\.\d+\.\d+)/

        // Subagent control surface access patterns
        $subagent_control1 = "subagent.control" nocase
        $subagent_control2 = "subagents_control_surface" nocase
        $subagent_control3 = "control.subagent" nocase

        // Parent scope resolution indicators
        $parent_scope1 = "parent_requester_scope" nocase
        $parent_scope2 = "resolve_parent_scope" nocase
        $parent_scope3 = "session_tree.parent" nocase

        // Privilege escalation patterns
        $priv_esc1 = "leaf_worker.escalate" nocase
        $priv_esc2 = "bypass_sandbox" nocase
        $priv_esc3 = "tool_policies.broader" nocase

        // Exploitation indicators
        $exploit1 = "steer_sibling_runs" nocase
        $exploit2 = "kill_sibling" nocase
        $exploit3 = "insufficient_auth_check" nocase

        // Memory patterns for runtime exploitation
        $mem_pattern1 = { 73 75 62 61 67 65 6E 74 [4-8] 63 6F 6E 74 72 6F 6C }  // "subagent" + control
        $mem_pattern2 = { 70 61 72 65 6E 74 [4-8] 72 65 71 75 65 73 74 65 72 } // "parent" + requester

    condition:
        (
            // Binary identification
            ($openclaw_binary and $version_pattern) or

            // Control surface access patterns
            (2 of ($subagent_control*)) or

            // Parent scope resolution
            (any of ($parent_scope*)) or

            // Privilege escalation attempts
            (any of ($priv_esc*)) or

            // Direct exploitation indicators
            (any of ($exploit*)) or

            // Memory-based detection
            (any of ($mem_pattern*))
        ) and

        // File size constraints
        filesize < 50MB
}

rule CVE_2026_32915_OpenClaw_Config_Exploit {
    meta:
        author = "Security Engineer"
        description = "Detects OpenClaw configuration files with sandbox bypass indicators"
        cve = "CVE-2026-32915"
        date = "2024"
        reference = "OpenClaw sandbox bypass configuration exploitation"

    strings:
        // Configuration file indicators
        $config1 = "sandbox.bypass" nocase
        $config2 = "leaf.privilege" nocase
        $config3 = "subagent.access.unrestricted" nocase

        // Policy override patterns
        $policy1 = "tool_policy.override" nocase
        $policy2 = "authorization.skip" nocase
        $policy3 = "session_tree.bypass" nocase

        // JSON/XML exploitation patterns
        $json_exploit = /"sandbox"\s*:\s*\{\s*"bypass"\s*:\s*true/ nocase
        $xml_exploit = /<sandbox.*bypass.*=.*true/i

    condition:
        (
            (2 of ($config*)) or
            (any of ($policy*)) or
            ($json_exploit) or
            ($xml_exploit)
        ) and
        filesize < 10MB
}

rule CVE_2026_32915_OpenClaw_Memory_Exploitation {
    meta:
        author = "Security Engineer"
        description = "Detects in-memory exploitation of OpenClaw sandbox bypass"
        cve = "CVE-2026-32915"
        date = "2024"
        reference = "Runtime memory patterns for sandbox bypass"

    strings:
        // Memory corruption patterns
        $mem_corrupt1 = { 4C 65 61 66 57 6F 72 6B 65 72 [8-16] 45 73 63 61 6C 61 74 65 } // LeafWorker + Escalate
        $mem_corrupt2 = { 53 75 62 61 67 65 6E 74 43 6F 6E 74 72 6F 6C [4-12] 42 79 70 61 73 73 } // SubagentControl + Bypass

        // Function call patterns
        $func_call1 = "resolve_against_parent_scope"
        $func_call2 = "access_control_surface"
        $func_call3 = "bypass_session_tree"

        // API abuse patterns
        $api_abuse1 = { FF 15 [4] 83 C4 [1] 85 C0 74 [1-3] 68 [4] 68 [4] } // API call pattern

    condition:
        (
            (any of ($mem_corrupt*)) or
            (2 of ($func_call*)) or
            ($api_abuse1)
        )
}

:material-file-download: prevention/yara.yar

# Block OpenClaw sandbox bypass attempts (CVE-2026-32915)
location ~* /(?:subagent|control|worker|sandbox)/ {
    # Block requests attempting to access subagent control surface
    if ($request_body ~* "(?:subagent|control_surface|parent_requester|session_tree|leaf_worker)") {
        return 403;
    }

    # Block suspicious control request patterns
    if ($args ~* "(?:scope=parent|worker_id=\.\.|control=sibling|policy=elevated)") {
        return 403;
    }

    # Block path traversal attempts in subagent requests
    if ($uri ~* "\.\.\/|%2e%2e%2f|%252e%252e%252f") {
        return 403;
    }

    # Add security headers for subagent endpoints
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-Sandbox-Policy "strict-origin-when-cross-origin";
}

# Block OpenClaw API endpoints vulnerable to privilege escalation
location ~* /api/v[0-9]+/(?:subagents?|workers?|control)/ {
    # Block requests with suspicious authorization headers
    if ($http_authorization ~* "(?:leaf|worker).*(?:parent|root|admin)") {
        return 403;
    }

    # Block malformed session context requests
    if ($request_body ~* "session_tree.*parent|scope.*escalate|privilege.*elevation") {
        return 403;
    }

    # Restrict HTTP methods for control endpoints
    if ($request_method !~ ^(GET|POST)$) {
        return 405;
    }
}

# Block direct access to internal OpenClaw components
location ~* /internal/(?:sandbox|boundary|resolver)/ {
    # Block all external access to internal components
    return 403;
}

# Filter requests containing OpenClaw exploit patterns
location / {
    # Block requests with sandbox bypass payloads
    if ($request_body ~* "(?:bypass.*sandbox|leaf.*escalate|worker.*sibling|control.*unauthorized)") {
        return 403;
    }

    # Block query parameters indicating exploitation attempts
    if ($args ~* "(?:sandbox_bypass|privilege_escalation|subagent_hijack|policy_override)") {
        return 403;
    }

    # Block User-Agent strings associated with OpenClaw exploits
    if ($http_user_agent ~* "(?:OpenClaw.*Exploit|SandboxBypass|SubagentHijack)") {
        return 403;
    }
}

# Rate limiting for OpenClaw control requests
location ~* /(?:control|manage|admin)/ {
    limit_req zone=control_requests burst=5 nodelay;

    # Additional validation for control requests
    if ($request_body ~* "kill.*sibling|steer.*worker|resolve.*parent") {
        return 403;
    }
}

:material-file-download: prevention/nginx.conf

# ModSecurity Rules for CVE-2026-32915 - OpenClaw Sandbox Boundary Bypass
# Protects against leaf subagent privilege escalation and unauthorized control surface access

# Rule 1000000: Block requests attempting to access subagent control surface from leaf workers
SecRule REQUEST_URI "@rx (?i)/(?:subagent|agent)/?(?:control|admin|manage)" \
    "id:1000000,\
    phase:1,\
    block,\
    severity:CRITICAL,\
    msg:'CVE-2026-32915: Potential OpenClaw subagent control surface access attempt',\
    logdata:'URI: %{REQUEST_URI}, Client: %{REMOTE_ADDR}',\
    tag:'cve-2026-32915',\
    tag:'openclaw',\
    tag:'sandbox-bypass'"

# Rule 1000001: Detect requests with parent scope resolution patterns
SecRule ARGS "@rx (?i)(?:parent|\.\.\/|scope|tree|session).*(?:resolve|access|escalate)" \
    "id:1000001,\
    phase:2,\
    block,\
    severity:HIGH,\
    msg:'CVE-2026-32915: Suspicious parent scope resolution attempt detected',\
    logdata:'Matched argument: %{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\
    tag:'cve-2026-32915',\
    tag:'scope-bypass'"

# Rule 1000002: Block requests with unauthorized tool policy manipulation patterns
SecRule REQUEST_BODY "@rx (?i)(?:tool.?policy|policy.?override|privilege.?escalat)" \
    "id:1000002,\
    phase:2,\
    block,\
    severity:HIGH,\
    msg:'CVE-2026-32915: Attempt to manipulate tool policies detected',\
    logdata:'Request body contains policy manipulation patterns',\
    tag:'cve-2026-32915',\
    tag:'policy-manipulation'"

# Rule 1000003: Detect sibling worker targeting attempts
SecRule ARGS "@rx (?i)(?:sibling|worker|peer).*(?:kill|stop|terminate|steer|control)" \
    "id:1000003,\
    phase:2,\
    block,\
    severity:HIGH,\
    msg:'CVE-2026-32915: Potential sibling worker targeting attempt',\
    logdata:'Suspicious sibling targeting in: %{MATCHED_VAR_NAME}',\
    tag:'cve-2026-32915',\
    tag:'sibling-attack'"

# Rule 1000004: Block requests with authorization bypass indicators
SecRule REQUEST_HEADERS:Authorization "@rx (?i)(?:bypass|override|escalate|inherit)" \
    "id:1000004,\
    phase:1,\
    block,\
    severity:MEDIUM,\
    msg:'CVE-2026-32915: Authorization bypass attempt in headers',\
    logdata:'Authorization header: %{MATCHED_VAR}',\
    tag:'cve-2026-32915',\
    tag:'auth-bypass'"

# Rule 1000005: Monitor for suspicious session tree manipulation
SecRule ARGS "@rx (?i)session.?tree.*(?:modify|alter|bypass|escape)" \
    "id:1000005,\
    phase:2,\
    block,\
    severity:MEDIUM,\
    msg:'CVE-2026-32915: Session tree manipulation attempt detected',\
    logdata:'Session manipulation in parameter: %{MATCHED_VAR_NAME}',\
    tag:'cve-2026-32915',\
    tag:'session-manipulation'"

# Rule 1000006: Block requests attempting to access broader execution contexts
SecRule REQUEST_URI "@rx (?i)/(?:exec|run|execute).*(?:broad|parent|elevated|admin)" \
    "id:1000006,\
    phase:1,\
    block,\
    severity:HIGH,\
    msg:'CVE-2026-32915: Attempt to access broader execution context',\
    logdata:'Suspicious execution request: %{REQUEST_URI}',\
    tag:'cve-2026-32915',\
    tag:'execution-escalation'"

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2026-32915?

CVE-2026-32915 is a High (8.8) vulnerability: OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32915?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32915?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

---

For authorized security testing and research only. See the full source and NVD record.