CVSS 4.0
9.2 criticalCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:NCVE-2026-32918
Critical (9.2) in openclaw openclaw. EPSS 0.1% chance of exploitation in the next 30 days. Fixed in openclaw 2026.3.11.
OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.
Severity
CVSS 3.1
8.4 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 0% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openclaw:openclaw
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wcxr-59v9-rxr8 | npm | openclaw | <2026.3.11 | 2026.3.11 |