CVE-2026-32918: OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool
OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the sessionstatus tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32918?
CVE-2026-32918 is considered a high severity vulnerability due to its potential impact on session security.
How do I fix CVE-2026-32918?
To fix CVE-2026-32918, upgrade OpenClaw to version 2026.3.11 or later.
What systems are affected by CVE-2026-32918?
CVE-2026-32918 affects all versions of OpenClaw prior to version 2026.3.11.
What type of attack does CVE-2026-32918 enable?
CVE-2026-32918 enables attackers to perform a session sandbox escape, gaining unauthorized access to parent or sibling session states.
Is CVE-2026-32918 remote exploitative?
Yes, CVE-2026-32918 can be exploited remotely by attackers able to supply arbitrary sessionKey values.