p PatchFirst

CVE-2026-35636

CVE-2026-35636 · OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before enforcing visibility checks. Sandboxed child sessions can exploit this to access parent or sibling sessions that should be blocked by explicit sessionKey restrictions.

CVSS 7.1 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 2026.3.11, < 2026.3.25: Affected (semver)
    • 2026.3.25: Not affected (semver)

    Update to 2026.3.25

  • openclaw npm

    Affected ranges
    • SEMVER: ≥ 2026.3.11, < 2026.3.28

    Update to 2026.3.28

Original sources

Check your server →