Openclaw EUVD-2026-16999

Requires local access to OpenClaw before version 2026.3.11 with low-privilege user permissions. Attacker exploits session_status tool to supply arbitrary sessionKey values, bypassing sandbox isolation for sandboxed subagents to access parent/sibling session state and persisted model overrides.

This vulnerability presents a critical risk despite requiring local authenticated access with low privileges (CVSS 4.0 AV:L/AC:L/PR:L). The 9.2 CVSS score reflects severe impact to confidentiality and integrity (VC:H/VI:H) with scope change indicating security boundary violation (SC:H/SI:H). The low attack complexity (AC:L) and absence of user interaction (UI:N) requirements suggest exploitation is straightforward for attackers with basic sandboxed subagent access. Real-world risk depends heavily on deployment context: environments using OpenClaw's sandbox isolation for multi-tenant workloads, adversarial AI research containment, or security-sensitive model serving face immediate data exposure and integrity compromise risks. The vulnerability undermines the fundamental security guarantee of sandbox isolation, potentially enabling lateral movement between sessions, data exfiltration across tenant boundaries, and persistent backdoor installation via model override manipulation. No public exploit identified at time of analysis and no CISA KEV listing, suggesting exploitation has not been observed in the wild, but the authentication bypass tag and clear attack path in vendor advisory indicate weaponization would be trivial for attackers with existing subagent access. Organizations relying on OpenClaw's sandbox isolation for security boundaries should treat this as a priority architectural failure requiring immediate remediation.

An attacker with low-privilege access to a sandboxed OpenClaw subagent environment executes the session_status diagnostic tool with a crafted sessionKey parameter pointing to a parent or sibling session identifier. The tool fails to validate authorization boundaries and returns sensitive session state data including API credentials, model configuration overrides, or user context information from the target session. The attacker then submits modified session data through the same tool to inject persistent backdoors via model override parameters, establishing unauthorized control over other isolated sessions without requiring elevated privileges or triggering typical access control alerts. This scenario is particularly dangerous in multi-tenant AI research platforms or shared agent hosting environments where sandbox isolation is the primary security boundary.