GHSA-wcxr-59v9-rxr8: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

March 13, 2026

The built-in session_status tool did not enforce the intended session-visibility boundary. A sandboxed subagent could supply another session’s sessionKey and inspect or modify state outside its own sandbox scope.

References

github.com/advisories/GHSA-wcxr-59v9-rxr8
github.com/openclaw/openclaw
github.com/openclaw/openclaw/releases/tag/v2026.3.11
github.com/openclaw/openclaw/security/advisories/GHSA-wcxr-59v9-rxr8

Code Behaviors & Features

Detect and mitigate GHSA-wcxr-59v9-rxr8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →