CVE-2026-41350

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A session visibility bypass exists where the session status() function fails to enforce configured tools.sessions.visibility restrictions during unsandboxed invocations. This allows attackers to invoke session status() without sandbox constraints, bypassing session-policy controls to access restricted session information.

Recommendations Update to version 2026.3.31 or later. As a temporary workaround, restrict access to the session status() function to minimize the risk of exploitation.