Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceGHSA-g5cg-8x5w-7jpm

GHSA-g5cg-8x5w-7jpm

CRITICAL9.0

OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

Published Apr 2, 2026

Modified 1 weeks ago

Fix available

Details

Summary

Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

Current Maintainer Triage

Status: open
Normalized severity: Critical

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

a30214a624946fc5c85c9558a27c1580172374fd — 2026-03-31T09:06:51+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

Affected Packages

openclaw

npm

Fixed in:

2026.3.31

References

https://github.com/advisories/GHSA-g5cg-8x5w-7jpm

https://github.com/openclaw/openclaw

https://github.com/openclaw/openclaw/commit/a30214a624946fc5c85c9558a27c1580172374fd

https://github.com/openclaw/openclaw/releases/tag/v2026.3.31

https://github.com/openclaw/openclaw/security/advisories/GHSA-g5cg-8x5w-7jpm

CVSS Analysis

CVSS v4.0

9.0

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

PresentAT:P

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

HighVC:H

Vuln. Integrity

HighVI:H

Vuln. Availability

HighVA:H

Subsequent System

Subseq. Confidentiality

HighSC:H

Subseq. Integrity

HighSI:H

Subseq. Availability

HighSA:H

9.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Ecosystems

Timeline

PublishedApr 2, 2026

ModifiedApr 2, 2026

GHSA-g5cg-8x5w-7jpm | Mondoo Vulnerability Intelligence