ClawHosters
by Daniel Samer
3 min read
March 21, 2026 was a rough day for OpenClaw self-hosters. A coordinated disclosure dropped over 10 high-severity CVEs hitting core OpenClaw components. That's the largest single-day CVE batch in the project's history.
For context, CrowdStrike's recent assessment already tracks 156 total advisories for OpenClaw. 28 have published CVE IDs, 128 more are still awaiting assignment. This batch adds to an already serious pile.
The Worst Offenders
CVE-2026-32042 (CVSS 8.8): Privilege Escalation. Unpaired devices could self-assign operator.admin scope. Think about that for a second. Any device connecting to your instance could grant itself full admin access without you knowing. Fixed in v2026.2.25.
CVE-2026-32051 (CVSS 8.8): Authorization Bypass. Callers with operator.write permissions could invoke owner-only tool surfaces. The permission boundary between operator and owner simply wasn't enforced correctly. Fixed in v2026.3.1.
CVE-2026-32048 (CVSS 7.5): Sandbox Escape. Child runtimes spawned via cross-agent sessions inherited sandbox.mode=off. If you're running agents that can spawn other agents, the sandboxing you thought was protecting you probably wasn't. Fixed in v2026.3.1.
CVE-2026-32056 (CVSS 7.5): RCE via Shell Startup. Attackers could inject environment variables through .bash_profile or .zshenv to bypass command allowlists entirely. Fixed in v2026.2.22.
All Patched in v2026.3.1+
Every CVE from this disclosure is fixed if you're running v2026.3.1 or later. The latest available version is v2026.3.13-1. If you're more than a few versions behind, you're exposed to multiple attack vectors at once.
ClawHosters Instances: Already Protected
Here's the part that matters for managed hosting customers. ClawHosters instances auto-update. By the time these CVEs went public on March 21, every managed instance was already running patched versions. No manual intervention needed. No scrambling to update. No hoping you didn't miss one.
Self-hosting? You need to update now. Not tomorrow, not next week. Check our security hardening guide and run the safety scanner against your setup.
Or skip the maintenance burden entirely and let ClawHosters handle it.
