GitHub Advisoryadvisory · npm

GHSA-q2qc-744p-66r2 OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility

HIGH Published 2026-03-29 Modified 2026-03-29 Official page ↗
Ecosystem
npm
Packages
openclaw
Severity
High
Weaknesses
CWE-639, CWE-863
Reviewed
2026-03-29

Affected packages

• npm openclaw: >= 2026.3.11, < 2026.3.28 → fixed in 2026.3.28

Description

Summary `session_status` sessionId resolution bypasses sandboxed session-tree visibility Affected Packages / Versions • Package: `openclaw` • Affected versions: `>= 2026.3.11, <= 2026.3.24` • First patched version: `2026.3.25` • Latest published npm version at verification time: `2026.3.24` Details `session_status` previously resolved a `sessionId` to a canonical session key after early visibility checks, letting sandboxed children reach parent or sibling sessions that were blocked by explicit `sessionKey`. Commit `d9810811b6c3c9266d7580f00574e5e02f7663de` enforces visibility after `sessionId` resolution so sandboxed callers cannot escape their session tree. Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `d9810811b6c3c9266d7580f00574e5e02f7663de`. Fix Commit(s) • `d9810811b6c3c9266d7580f00574e5e02f7663de`

Related

Weakness · CWE (2)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-863 Incorrect Authorization weakness

References