Session Visibility Bypass Vulnerability in OpenClaw by OpenClaw Inc.
CVE-2026-41350

5.3MEDIUM

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
23 April 2026

What is CVE-2026-41350?

The vulnerability found in OpenClaw before version 2026.3.31 allows attackers to bypass session-policy controls through the session_status function. This occurs when the function is called without sandbox constraints, leading to unauthorized access to sensitive session information that should be restricted. Proper configurations of the tools.sessions.visibility restrictions are not enforced during unsandboxed invocations, creating a security risk that needs immediate attention.

Affected Version(s)

OpenClaw 0 < 2026.3.31

OpenClaw 2026.3.31

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/4d369a3400dc9...
patch
https://www.vulncheck.com/advisories/openclaw-session-vis...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

tdjackey
.