CVE-2026-53826CWE-668

OpenClaw < 2026.4.26 - Information Disclosure via Sandboxed Session Spawn

Low · published June 12, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exploit this by spawning child sessions from sandboxed parents to reveal host workspace location or related memory context to child models.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00317 · 23.3th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2026-06-12T21:56Z
EPSS history
Timeline
  • 12 JUN 21:56Z
    OpenClaw < 2026.4.26 - Information Disclosure via Sandboxed Session Spawn
    cvelistv5