CVE-2026-35636
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Apr 9, 2026
CISA due date
—
The record
OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before enforcing visibility checks. Sandboxed child sessions can exploit this to access parent or sibling sessions that should be blocked by explicit sessionKey restrictions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-59305 Partition interceptor may be improperly added while sending message. CWE-696
- CVE-2026-68930 Russh is a Rust SSH client & server library. CWE-696
- CVE-2026-67217 cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in… CWE-696
- CVE-2026-56355 GNU Savannah Administration Savane through 3.17 uses untrusted data as part of… CWE-696
- CVE-2026-49317 Incorrect behavior order in the Infotainment / Digital Round display of the Indian… CWE-696
- CVE-2026-49318 Incorrect behavior order in the Infotainment / Digital Round display of the Indian… CWE-696
- CVE-2026-44919 In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop… CWE-696
- CVE-2026-45033 GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. CWE-696