CVE-2026-32918: OpenClaw session sandbox escape

CISO Take

OpenClaw before 2026.3.11 contains a session sandbox escape in its session_status tool that lets sandboxed subagents supply arbitrary sessionKey values to read or overwrite session data belonging to parent or sibling agents—including persisted model override configurations. For organizations running multi-agent AI pipelines, this shatters the isolation model separating trusted orchestrator state from untrusted subagent execution, meaning a single compromised or malicious skill can tamper with the entire agent hierarchy. The EPSS percentile places this in the top 99th percentile for exploitation likelihood, exploitation requires only low privileges and no user interaction (CVSS 8.4, Scope Changed), and the package's 396 prior CVEs signal systemic security debt that raises confidence in active adversary interest. Patch immediately to OpenClaw 2026.3.11 or later, restrict session_status invocations to trusted orchestrator roles, rotate any credentials stored in session context, and audit all multi-agent OpenClaw deployments for signs of cross-session access.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

High. The CVSS Scope Changed flag is the critical signal—it confirms the vulnerability crosses authorization boundaries, amplifying blast radius well beyond the initially compromised subagent. Low attack complexity and no user interaction mean exploitation is straightforward for any actor with low-privilege subagent access. The 99th percentile EPSS indicates this vulnerability class sees real-world adversary attention, and the documented OpenClaw skill ecosystem abuse in AIID #1368 confirms that adversaries are already targeting this attack surface. The absence of a public exploit or KEV listing provides limited comfort given trivially low exploitation prerequisites. A package carrying 396 CVEs also signals that additional undiscovered issues are likely co-present.

How does the attack unfold?

Malicious Skill Injection

Adversary publishes or compromises a third-party OpenClaw skill on ClawHub that is subsequently installed and invoked as a sandboxed subagent within an enterprise multi-agent pipeline.

AML.T0010.005

Sandbox Escape via Tool Abuse

The malicious subagent calls the session_status tool with enumerated arbitrary sessionKey values, bypassing sandbox isolation to enumerate and access parent and sibling agent session state.

AML.T0053

Session State Harvest

Attacker reads conversation history, API credentials, and persisted model override configurations from the compromised orchestrator and sibling agent session states.

AML.T0085.001

Persistent Agent Compromise

Attacker writes malicious model overrides into the orchestrator's session state, redirecting future agent queries to an adversary-controlled endpoint for long-term silent data exfiltration.

AML.T0081

Malicious Skill Injection

Adversary publishes or compromises a third-party OpenClaw skill on ClawHub that is subsequently installed and invoked as a sandboxed subagent within an enterprise multi-agent pipeline.

AML.T0010.005

Sandbox Escape via Tool Abuse

The malicious subagent calls the session_status tool with enumerated arbitrary sessionKey values, bypassing sandbox isolation to enumerate and access parent and sibling agent session state.

AML.T0053

Session State Harvest

Attacker reads conversation history, API credentials, and persisted model override configurations from the compromised orchestrator and sibling agent session states.

AML.T0085.001

Persistent Agent Compromise

Attacker writes malicious model overrides into the orchestrator's session state, redirecting future agent queries to an adversary-controlled endpoint for long-term silent data exfiltration.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.4 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Changed

C High

I High

A None

What should I do?

6 steps

Patch to OpenClaw 2026.3.11 or later immediately per vendor advisory GHSA-wcxr-59v9-rxr8.
If patching is blocked, restrict session_status tool invocations at the framework configuration level so only the trusted orchestrator role can call it—block subagent access entirely.
Rotate all credentials, API keys, and sensitive tokens stored in session context on any potentially affected deployment.
Enable audit logging for session_status calls and alert on sessionKey values outside the invoking agent's own session scope.
Review multi-agent pipeline designs to minimize sensitive data stored in session state; prefer ephemeral credential delivery over session persistence.
Apply tightened skill allowlisting in OpenClaw environments to limit the attack surface for supply-chain-delivered exploitation.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Privacy Violation Agent Framework AML.T0010.005 - AI Agent Tool AML.T0053 - AI Agent Tool Invocation AML.T0080 - AI Agent Context Poisoning AML.T0081 - Modify AI Agent Configuration AML.T0085.001 - AI Agent Tools AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

A.6.1.3 - AI system roles and responsibilities A.9.1 - AI system technical security controls

NIST AI RMF

GOVERN 1.7 - Processes for AI supply chain risk management

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32918?

OpenClaw before 2026.3.11 contains a session sandbox escape in its session_status tool that lets sandboxed subagents supply arbitrary sessionKey values to read or overwrite session data belonging to parent or sibling agents—including persisted model override configurations. For organizations running multi-agent AI pipelines, this shatters the isolation model separating trusted orchestrator state from untrusted subagent execution, meaning a single compromised or malicious skill can tamper with the entire agent hierarchy. The EPSS percentile places this in the top 99th percentile for exploitation likelihood, exploitation requires only low privileges and no user interaction (CVSS 8.4, Scope Changed), and the package's 396 prior CVEs signal systemic security debt that raises confidence in active adversary interest. Patch immediately to OpenClaw 2026.3.11 or later, restrict session_status invocations to trusted orchestrator roles, rotate any credentials stored in session context, and audit all multi-agent OpenClaw deployments for signs of cross-session access.

Is CVE-2026-32918 actively exploited?

No confirmed active exploitation of CVE-2026-32918 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32918?

1. Patch to OpenClaw 2026.3.11 or later immediately per vendor advisory GHSA-wcxr-59v9-rxr8. 2. If patching is blocked, restrict session_status tool invocations at the framework configuration level so only the trusted orchestrator role can call it—block subagent access entirely. 3. Rotate all credentials, API keys, and sensitive tokens stored in session context on any potentially affected deployment. 4. Enable audit logging for session_status calls and alert on sessionKey values outside the invoking agent's own session scope. 5. Review multi-agent pipeline designs to minimize sensitive data stored in session state; prefer ephemeral credential delivery over session persistence. 6. Apply tightened skill allowlisting in OpenClaw environments to limit the attack surface for supply-chain-delivered exploitation.

What systems are affected by CVE-2026-32918?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI agent sandboxing.

What is the CVSS score for CVE-2026-32918?

CVE-2026-32918 has a CVSS v3.1 base score of 8.4 (HIGH). The EPSS exploitation probability is 0.10%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationAI agent sandboxing

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0053 AI Agent Tool Invocation

AML.T0080 AI Agent Context Poisoning

AML.T0081 Modify AI Agent Configuration

AML.T0085.001 AI Agent Tools

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: A.6.1.3, A.9.1

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.

Exploitation Scenario

An adversary publishes a malicious OpenClaw skill to ClawHub—consistent with the documented AIID #1368 abuse pattern where ~17% of skills were assessed as malicious. When an enterprise multi-agent pipeline installs the skill and invokes it as a sandboxed subagent, the skill iterates through candidate sessionKey values via the session_status tool. With low complexity and no user interaction required, the subagent quickly enumerates parent and sibling session states, extracting the orchestrator's conversation history, stored API credentials, and persisted model override configurations. The attacker then writes a malicious model override into the orchestrator's session state pointing to an adversary-controlled endpoint. All subsequent legitimate agent queries silently route through this endpoint, enabling long-term credential harvesting and data exfiltration without further access.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.