Which versions of Openclaw are affected by EUVD-2026-16999?

CVE-2026-32918 is a critical session isolation bypass in OpenClaw that allows authenticated low-privilege users within sandboxed environments to read and modify session data across security…. A patch is available.

How to fix or mitigate EUVD-2026-16999?

Within 24 hours: Identify all systems running OpenClaw versions prior to 2026.3.11 and document current deployment scope. Within 7 days: Contact vendor for patch timeline and interim compensating control guidance; restrict low-privilege sandboxed subagent access to trusted environments only; implement network-level session isolation if possible. Within 30 days: Apply vendor-released patch immediately upon availability to OpenClaw 2026.3.11 or later; validate sandbox isolation in test environment before production deployment.

Openclaw EUVD-2026-16999

Q: What is the CVSS score of EUVD-2026-16999?

EUVD-2026-16999 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-32918 CRITICAL

Incorrect Authorization (CWE-863)

2026-03-29 VulnCheck

GHSA-wcxr-59v9-rxr8

Authentication Bypass Openclaw

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 29, 2026 - 13:15 euvd

EUVD-2026-16999

Analysis Generated

Mar 29, 2026 - 13:15 vuln.today

CVE Published

Mar 29, 2026 - 12:44 nvd

CRITICAL 9.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.11.

DescriptionCVE.org

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.

AnalysisAI

Session sandbox escape in OpenClaw versions prior to 2026.3.11 allows local authenticated attackers with low-privilege sandboxed subagent access to read and modify session data across isolation boundaries by manipulating sessionKey parameters in the session_status tool. Exploitation enables unauthorized access to parent or sibling session state including persisted model overrides, bypassing critical security isolation controls. No public exploit identified at time of analysis, though the authentication bypass mechanism is clearly documented in vendor security advisory.

Technical ContextAI

OpenClaw implements a session sandbox architecture designed to isolate subagent processes from parent and sibling session contexts. The session_status tool, intended for diagnostic purposes within sandboxed environments, fails to properly validate or restrict sessionKey input parameters (CWE-863: Incorrect Authorization). This authorization bypass allows sandboxed subagents to supply arbitrary sessionKey values, effectively traversing the session isolation boundary. The vulnerability affects the core session management layer where persisted model overrides and sensitive session state are stored. According to the CPE identifier (cpe:2.3:a:openclaw:openclaw), this impacts the core OpenClaw application framework prior to the 2026.3.11 release. The flaw represents a fundamental breakdown in the principle of least privilege enforcement within the sandbox architecture, where isolated components should only access their designated session scope.

RemediationAI

Immediately upgrade to OpenClaw version 2026.3.11 or later, which contains vendor-released patches addressing the session_status tool authorization bypass. The fix implements proper sessionKey validation and enforces sandbox boundary restrictions to prevent cross-session access. Organizations should prioritize deployment environments where multiple sandboxed subagents operate with different trust levels or tenant isolation requirements. Review session audit logs for anomalous sessionKey access patterns that may indicate prior exploitation attempts, specifically looking for subagent processes accessing session identifiers outside their designated scope. Until patching is complete, consider disabling the session_status tool if operationally feasible, restricting subagent deployment to single-tenant contexts, or implementing additional access controls at the infrastructure layer to limit local authenticated user privileges. Consult the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-wcxr-59v9-rxr8 for detailed remediation guidance and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-session-sandbox-escape-via-session-status-tool for additional technical context.