CVE-2026-32918

critical · 9.2

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.

9.2

CVSS

0.1%

EPSS (exploit prob.)

1st

EPSS percentile

2026-03-29

Published

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-863

Affected products

Vendor	Product	Affected versions
openclaw	openclaw	< 2026.3.11

Check a specific version with /api/v1/cve/match.

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-wcxr-59v9-rxr8
https://www.vulncheck.com/advisories/openclaw-session-sandbox-escape-via-session-status-tool

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-32918