HarborGuard / CVE
Back to search
CRITICALCVE-2026-32918Published Modified CNA VulnCheck

CVE-2026-32918: OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.

Metrics

CVSS v4.0
9.2
Severity
CRITICAL
Fixed in
2026.3.11
Affected Products
1

Fix available

2026.3.11
Affected packages
  • OpenClaw / OpenClaw
    < 2026.3.11 (from 0)
    Fixed in 2026.3.11
CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
References