CVE-2026-32918: Openclaw Auth Bypass Vulnerability

CVE-2026-32918 Overview

CVE-2026-32918 is a critical session sandbox escape vulnerability in OpenClaw before version 2026.3.11. The flaw exists in the session_status tool and allows sandboxed subagents to bypass intended security boundaries and access parent or sibling session state. Attackers can exploit this vulnerability by supplying arbitrary sessionKey values to read or modify session data outside their designated sandbox scope, including persisted model overrides.

Critical Impact

Successful exploitation allows attackers to escape sandbox isolation, enabling unauthorized access to sensitive session data and the ability to modify persisted model configurations across session boundaries.

Affected Products

• OpenClaw versions prior to 2026.3.11
• OpenClaw for Node.js (all affected versions)
• OpenClaw subagent deployments using session sandboxing

Discovery Timeline

• 2026-03-29 - CVE-2026-32918 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-32918

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization), indicating a fundamental flaw in the authorization mechanisms governing session access within the OpenClaw sandboxing architecture. The session_status tool fails to properly validate whether a requesting subagent has legitimate access rights to the session identified by the provided sessionKey parameter.

In a properly functioning sandbox environment, subagents should only have visibility into their own session state, with strict isolation preventing cross-session data access. However, the vulnerable implementation accepts arbitrary sessionKey values without verifying that the requesting entity is authorized to access the corresponding session.

Root Cause

The root cause stems from insufficient authorization checks in the session_status tool's session key validation logic. The tool accepts user-supplied sessionKey parameters and directly uses them to retrieve session data without verifying that the requesting subagent's context matches the target session's ownership or permission model. This allows any sandboxed subagent to reference sessions belonging to parent processes or sibling subagents by simply knowing or guessing valid session keys.

Attack Vector

The attack vector is local, requiring the attacker to have the ability to execute code within a sandboxed subagent context. The attack workflow involves:

1. A malicious or compromised subagent crafts a request to the session_status tool
2. The attacker supplies a sessionKey value corresponding to a different session (parent or sibling)
3. The vulnerable tool processes the request without proper authorization validation
4. The attacker gains read or write access to the targeted session's state data
5. Persisted model overrides and other sensitive configuration data can be exfiltrated or modified

The vulnerability is particularly dangerous in multi-tenant or shared environments where multiple subagents operate under the assumption of strong isolation boundaries. For detailed technical information, refer to the GitHub Security Advisory and the VulnCheck Security Advisory.

Detection Methods for CVE-2026-32918

Indicators of Compromise

• Unusual cross-session access patterns in application logs showing subagents requesting session data outside their normal scope
• Unexpected modifications to persisted model overrides that cannot be attributed to authorized processes
• Anomalous session_status tool invocations with session keys that don't match the invoking subagent's assigned session

Detection Strategies

• Implement logging and monitoring for all session_status tool invocations, capturing both the requesting entity and the target sessionKey
• Create alerts for any session access requests where the requested sessionKey does not match the expected session for the requesting subagent
• Deploy behavioral analysis to detect patterns of session enumeration or systematic session key probing

Monitoring Recommendations

• Enable verbose logging for the session_status tool to capture all parameter values
• Monitor for elevated rates of session access failures that may indicate exploitation attempts
• Establish baseline behavior for normal subagent session access patterns to facilitate anomaly detection

How to Mitigate CVE-2026-32918

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.11 or later immediately
• Audit all subagent deployments for potential unauthorized session access
• Review session data integrity, particularly persisted model overrides, for signs of tampering
• Restrict network access to OpenClaw deployments until patches can be applied

Patch Information

The vendor has addressed this vulnerability in OpenClaw version 2026.3.11. Security patches and upgrade instructions are available through the official GitHub Security Advisory (GHSA-wcxr-59v9-rxr8). Organizations should prioritize this update given the critical severity rating.

Workarounds

• Implement network segmentation to limit which systems can interact with OpenClaw deployments
• Disable or restrict access to the session_status tool if not operationally required pending patch deployment
• Deploy additional authorization controls at the application layer to validate session access requests
• Monitor and audit all subagent activity with enhanced logging until the patch is applied