CVE-2026-32918CWE-863

OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool

Critical · published March 29, 2026

CVSS v4.0
9.2
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00147 · 3.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-29T12:44Z
EPSS history
Timeline
  • 29 MAR 12:44Z
    OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool
    cvelistv5