EUVD-2026-21128
GHSA-55rv-68q5-wxmq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as sandboxed child session
-
ExploitInvoke session_status with target sessionId
-
ExecutionBypass sessionKey visibility checks via canonical resolution
-
ImpactAccess parent or sibling session data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect behavior order
|
| Exploitation Conditions | Requires authenticated access to OpenClaw 2026.3.11–2026.3.24. Attacker must have a sandboxed child session and exploit the session_status function's failure to enforce visibility checks before resolving sessionId to canonical keys, allowing access to parent or sibling sessions. |
| Impact | Authenticated users can bypass session isolation to access parent or sibling sessions via sessionId resolution flaw. CVSS 7.1 reflects high confidentiality impact; requires prior login. Low observed exploitation activity. Patch available. Priority depends on multi-tenant deployments where session segregation enforces data boundaries. |
| Exploit ScenarioDerived | Authenticated attacker calls session_status with canonical sessionId of parent/sibling session. Application resolves sessionId before applying sessionKey visibility checks, returning sensitive session data. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Session isolation bypass in OpenClaw 2026.3.11 through 2026.3.24 allows authenticated attackers to access parent or sibling sessions bypassing visibility restrictions. The vulnerability exploits session_status logic that resolves sessionId to canonical session keys before enforcing explicit sessionKey-based access controls, enabling sandboxed child sessions to read data from sessions they should not access. No public exploit identified at time of analysis. Impacts confidentiality of session data across isolation boundaries in multi-tenant or sandboxed deployment scenarios.
RemediationAI
Vendor-released patch: upgrade to OpenClaw version containing commit d9810811b6c3c9266d7580f00574e5e02f7663de or later. The fix reorders session_status validation to enforce sessionKey visibility checks before canonical resolution, preventing unauthorized session traversal. Organizations unable to upgrade immediately should audit session isolation configurations and consider restricting child session creation privileges until patching is complete. Review access logs for suspicious cross-session access attempts by sandboxed contexts. Vendor advisory available at https://github.com/openclaw/openclaw/security/advisories/GHSA-q2qc-744p-66r2 and technical details at https://www.vulncheck.com/advisories/openclaw-session-isolation-bypass-via-sessionid-resolution
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause stems from premature canonical resolution in session_status processing (CWE-696: Incorrect Behavior Order). The function converts sessionId to canonical keys before applying sessionKey visibility filters, allowing sandboxed child contexts to reference restricted parent/sibling sessions through identifier manipulation. Authentication is required (CVSS PR:L), but once authenticated, attackers can traverse session boundaries that should enforce strict isolation via explicit key constraints.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before enforcing visibility checks. Sandboxed child sessions can exploit this to access parent or sibling sessions that should be blocked by explicit sessionKey restrictions.
Blast Radius
ecosystem impact- 3 npm packages depend on openclaw (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.11.
Executive ViewAI
OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass that allows authenticated users to access data from other sessions they should not see, creating a confidentiality risk in multi-tenant or sandboxed environments. This vulnerability could expose sensitive session data across organizational or customer boundaries if OpenClaw is used in shared deployment models.
Apply vendor patch. If immediate patching is not feasible, implement network-level access restrictions to limit authenticated user accounts and consider disabling multi-tenant or sandboxed session modes until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB