PT-2026-31771

CVE-2026-35636

Published

2026-03-29

Updated

2026-04-10

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.3.11 through 2026.3.24

Description OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass. The session status function resolves sessionId to canonical session keys before enforcing visibility checks. This allows sandboxed child sessions to access parent or sibling sessions that should be blocked by explicit sessionKey restrictions.

Recommendations Update to a version later than 2026.3.24.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Nathan

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key