CVE-2026-32918: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
(updated )
The built-in session_status tool did not enforce the intended session-visibility boundary. A sandboxed subagent could supply another session’s sessionKey and inspect or modify state outside its own sandbox scope.
References
- github.com/advisories/GHSA-wcxr-59v9-rxr8
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/releases/tag/v2026.3.11
- github.com/openclaw/openclaw/security/advisories/GHSA-wcxr-59v9-rxr8
- nvd.nist.gov/vuln/detail/CVE-2026-32918
- www.vulncheck.com/advisories/openclaw-session-sandbox-escape-via-session-status-tool
Code Behaviors & Features
Detect and mitigate CVE-2026-32918 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →