CVE-2026-53826: OpenClaw < 2026.4.26 - Information Disclosure via Sandboxed Session Spawn
OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exploit this by spawning child sessions from sandboxed parents to reveal host workspace location or related memory context to child models.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.4.26
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53826?
The severity of CVE-2026-53826 is classified as low with a score of 2.3.
How do I fix CVE-2026-53826?
To fix CVE-2026-53826, update OpenClaw to version 2026.4.26 or later.
What type of vulnerability is CVE-2026-53826?
CVE-2026-53826 is an information disclosure vulnerability affecting sandboxed session spawning.
Can CVE-2026-53826 be exploited remotely?
Yes, CVE-2026-53826 can be exploited remotely as it allows attackers to spawn child sessions from sandboxed parents.
What does the information disclosure in CVE-2026-53826 expose?
CVE-2026-53826 exposes the real workspace path and related memory context to child prompts.