clawsmith.com/signal/openclaw-claw-chain-four-sandbox-escape-cves-may-2026
⚠ IssueWide OpenLive
Claw Chain: 4 Chained OpenClaw Flaws Enable Sandbox Escape, Data Theft, Persistence
Cyera disclosed 4 CVEs (CVE-2026-44112 CVSS 9.6, CVE-2026-44113, CVE-2026-44115, CVE-2026-44118) that chain together for full sandbox escape in OpenClaw OpenShell backend. TOCTOU race conditions, heredoc injection, loopback impersonation. Patched in v2026.4.22.
Product Idea from this Signal
A runtime middleware that intercepts OpenClaw skill installs, sandboxes execution in an isolated environment, and blocks skills exhibiting credential exfiltration or reverse shell behavior
345 ▲RUNTIME-MIDDLEWARESECURITYOPEN-SOURCEDEVTOOLCONTAINER
CompetitiveView Opportunity →
Virality Score
0
across 0 platforms
Details
Signalissue
Ecosystem—
Sources3
Platforms0
Updated9d ago
Trend→ stable
Top ideas
All ideas →Related signals
All signals →