PT-2026-34781 · Openclaw · Openclaw

Tdjackey · Published 2026-04-23 · Updated 2026-04-25 · CVE-2026-41350

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A session visibility bypass exists where the session status() function fails to enforce configured tools.sessions.visibility restrictions during unsandboxed invocations. This allows attackers to invoke session status() without sandbox constraints, bypassing session-policy controls to access restricted session information.

Recommendations Update to version 2026.3.31 or later. As a temporary workaround, restrict access to the session status() function to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-41350

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-fwjq-xwfj-gv75 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/4d369a3400dc9b737fbe8daa63f09d909ce7beb8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41350 · Security Note
• https://twitter.com/CVEnew/status/2048168359129387236 · Twitter Post
• https://vulncheck.com/advisories/openclaw-session-visibility-bypass-via-session-status-in-unsandboxed-invocations · Note