CVE-2026-35636

high

Description

OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before enforcing visibility checks. Sandboxed child sessions can exploit this to access parent or sibling sessions that should be blocked by explicit sessionKey restrictions.

References

Advisories
More

https://www.vulncheck.com/advisories/openclaw-session-isolation-bypass-via-sessionid-resolution

https://github.com/openclaw/openclaw/security/advisories/GHSA-q2qc-744p-66r2

https://github.com/openclaw/openclaw/commit/d9810811b6c3c9266d7580f00574e5e02f7663de

Details

Source: Mitre, NVD

Published: 2026-04-09

Updated: 2026-04-16

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 7.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00029