CVE-2026-42074: OpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input

Synopsis

A sandbox bypass vulnerability exists in OpenClaude, an open-source coding-agent CLI. The flaw allows the language model itself (treated as an untrusted principal in the project's own threat model) to disable the command sandbox by setting the dangerouslyDisableSandbox parameter to true in any tool response, reachable over the network with no authentication required. Successful exploitation gives an attacker full host-level code execution by injecting prompts that cause the model to escape the sandbox and run arbitrary commands. A patched-image rebuild at version 0.5.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The OpenClaude agent is exposed over the network, and an attacker can reach it to inject malicious prompts without needing local system access.

• AuthenticationNot required

  No credentials or account are needed to submit prompt input to the agent.

• Victim interactionNot required

  No user action beyond normal agent operation is required; the model processes the injected tool response autonomously.

• Attack complexityDetail

  Exploitation is reliable and condition-free: injecting the dangerouslyDisableSandbox flag requires no race condition, memory knowledge, or environmental prerequisite.

Blast Radius

• Attacker executes arbitrary shell commands on the host running the OpenClaude agent with the full privileges of that process.
• Attacker reads any file accessible to the agent process, including secrets, credentials, and source code on the host filesystem.
• Attacker writes or modifies files on the host, enabling persistence, backdoor installation, or corruption of build artifacts.
• Attacker disrupts or terminates any process reachable from the host, causing service outages for any workload co-located on that machine.