CVE-2026-35636: OpenClaw session isolation bypass

CISO Take

OpenClaw versions 2026.3.11–2026.3.24 contain a session isolation bypass where the session_status API resolves a sessionId to its canonical key before enforcing visibility restrictions, allowing a sandboxed child session to read parent or sibling sessions it should never access. The CVSS confidentiality impact is rated High (C:H), and an EPSS score placing this vulnerability in the top 83rd percentile means exploitation probability is significantly above average for the broader CVE population — notable despite the absence of a public exploit or CISA KEV listing. The attack path requires only low privileges and no user interaction over the network, making it accessible to any authenticated platform user, which is especially dangerous in multi-tenant or multi-session orchestration environments where session context may carry API keys, system prompts, or user PII. Organizations running OpenClaw should apply the patch at commit d9810811b6c3c9266d7580f00574e5e02f7663de or upgrade beyond 2026.3.24 immediately; as a temporary control, restrict child session creation to trusted principals and audit session_status API calls for out-of-scope session ID references.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium severity (CVSS 6.5) with high confidentiality impact and low attack complexity. EPSS top 83rd percentile indicates above-average exploitation probability relative to the broader CVE population. No public exploit or KEV listing reduces immediate urgency, but the exploitation path is operationally trivial — low privileges, network-accessible, no user interaction required — lowering the bar significantly for any authenticated adversary. Risk amplifies substantially in multi-tenant deployments, orchestration platforms with privileged parent sessions, or any environment where session context carries sensitive data such as API keys, user PII, or proprietary system prompts. The 396 other CVEs attributed to the same package signal a systemic security posture concern for openclaw as a dependency.

How does the attack unfold?

Initial Access

Attacker authenticates to an OpenClaw deployment using a low-privileged account, sufficient to create and manage agent sessions.

AML.T0012

Session Discovery

Attacker enumerates or infers target sessionId values for administrative or sibling sessions via application logs, error messages, or predictable ID patterns.

AML.T0006

Isolation Bypass

Attacker calls session_status from a sandboxed child session with the target sessionId; the server resolves the canonical session key before enforcing visibility checks, granting unauthorized read access.

AML.T0049

Data Exfiltration

Attacker reads exposed parent or sibling session state, extracting conversation history, system prompts, embedded API credentials, or sensitive user data for further exploitation.

AML.T0085

Initial Access

Attacker authenticates to an OpenClaw deployment using a low-privileged account, sufficient to create and manage agent sessions.

AML.T0012

Session Discovery

Attacker enumerates or infers target sessionId values for administrative or sibling sessions via application logs, error messages, or predictable ID patterns.

AML.T0006

Isolation Bypass

Attacker calls session_status from a sandboxed child session with the target sessionId; the server resolves the canonical session key before enforcing visibility checks, granting unauthorized read access.

AML.T0049

Data Exfiltration

Attacker reads exposed parent or sibling session state, extracting conversation history, system prompts, embedded API credentials, or sensitive user data for further exploitation.

AML.T0085

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

4 steps

Patch: upgrade OpenClaw beyond 2026.3.24. Apply commit d9810811b6c3c9266d7580f00574e5e02f7663de directly if a tagged patched release is not yet available.
Workaround: restrict session creation APIs to trusted, authenticated principals; prevent untrusted users from instantiating child sessions that could be weaponized for lateral session access.
Detection: audit session_status API call logs for sessionId values outside the requesting session's expected scope — specifically low-privileged sessions querying IDs associated with administrative or system-level parent sessions.
Architecture: avoid passing sensitive data (credentials, API keys) through session context; use dedicated secret management and inject secrets at the infrastructure layer instead of through agent session state.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0085 - Data from AI Services AML.T0105 - Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.1.2 - Information security in AI system development

NIST AI RMF

GOVERN 6.2 - Policies and procedures for privacy and data security

OWASP LLM Top 10

LLM06:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-35636?

OpenClaw versions 2026.3.11–2026.3.24 contain a session isolation bypass where the session_status API resolves a sessionId to its canonical key before enforcing visibility restrictions, allowing a sandboxed child session to read parent or sibling sessions it should never access. The CVSS confidentiality impact is rated High (C:H), and an EPSS score placing this vulnerability in the top 83rd percentile means exploitation probability is significantly above average for the broader CVE population — notable despite the absence of a public exploit or CISA KEV listing. The attack path requires only low privileges and no user interaction over the network, making it accessible to any authenticated platform user, which is especially dangerous in multi-tenant or multi-session orchestration environments where session context may carry API keys, system prompts, or user PII. Organizations running OpenClaw should apply the patch at commit d9810811b6c3c9266d7580f00574e5e02f7663de or upgrade beyond 2026.3.24 immediately; as a temporary control, restrict child session creation to trusted principals and audit session_status API calls for out-of-scope session ID references.

Is CVE-2026-35636 actively exploited?

No confirmed active exploitation of CVE-2026-35636 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35636?

1. Patch: upgrade OpenClaw beyond 2026.3.24. Apply commit d9810811b6c3c9266d7580f00574e5e02f7663de directly if a tagged patched release is not yet available. 2. Workaround: restrict session creation APIs to trusted, authenticated principals; prevent untrusted users from instantiating child sessions that could be weaponized for lateral session access. 3. Detection: audit session_status API call logs for sessionId values outside the requesting session's expected scope — specifically low-privileged sessions querying IDs associated with administrative or system-level parent sessions. 4. Architecture: avoid passing sensitive data (credentials, API keys) through session context; use dedicated secret management and inject secrets at the infrastructure layer instead of through agent session state.

What systems are affected by CVE-2026-35636?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI assistant platforms, sandboxed execution environments.

What is the CVSS score for CVE-2026-35636?

CVE-2026-35636 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationAI assistant platformssandboxed execution environments

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0085 Data from AI Services

AML.T0105 Escape to Host

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.1.2

NIST AI RMF: GOVERN 6.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before enforcing visibility checks. Sandboxed child sessions can exploit this to access parent or sibling sessions that should be blocked by explicit sessionKey restrictions.

Exploitation Scenario

An adversary with a low-privileged account on an OpenClaw-powered AI agent platform creates a sandboxed child session. The attacker calls session_status with a parent or sibling session's sessionId — obtained via enumeration, predictable ID patterns, or leaked application logs. Because OpenClaw resolves the sessionId to its canonical session key before evaluating whether the calling session has visibility rights, the child session receives the full state of the target session. This may include the parent's system prompt with embedded API credentials, ongoing task context shared between sibling sessions, or user-supplied sensitive data from a concurrent session. The attacker extracts this state for privilege escalation, pivoting to backend systems, or bulk user data exfiltration.

Weaknesses (CWE)

CWE-696 Incorrect Behavior Order

CWE-696 — Incorrect Behavior Order: The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Source: MITRE CWE corpus.