OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility

TRUNG BÌNH 6.5CVE-2026-35636 · GHSA-q2qc-744p-66r2 · Công bố 09/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-35636 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.26%, cao hơn 17.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.3.25, 2026.3.28 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`≥ 2026.3.11, < 2026.3.25`	`2026.3.25`
openclaw npm	`≥ 2026.3.11, < 2026.3.28`	`2026.3.28`

Mô tả

Summary

session_status sessionId resolution bypasses sandboxed session-tree visibility

Affected Packages / Versions

Package: openclaw
Affected versions: >= 2026.3.11, <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

session_status previously resolved a sessionId to a canonical session key after early visibility checks, letting sandboxed children reach parent or sibling sessions that were blocked by explicit sessionKey. Commit d9810811b6c3c9266d7580f00574e5e02f7663de enforces visibility after sessionId resolution so sandboxed callers cannot escape their session tree.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit d9810811b6c3c9266d7580f00574e5e02f7663de.

Fix Commit(s)

d9810811b6c3c9266d7580f00574e5e02f7663de

Mô tả của NVD

OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before enforcing visibility checks. Sandboxed child sessions can exploit this to access parent or sibling sessions that should be blocked by explicit sessionKey restrictions.