CVE-2026-35636

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Incorrect Behavior Order pada openclaw. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before enforcing visibility checks. Sandboxed child sessions can exploit this to access parent or sibling sessions that should be blocked by explicit sessionKey restrictions.

Rincian

Terbit di NVD

9 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-696: Incorrect Behavior Order

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-q2qc-744p-66r2 advisory vendor
• https://github.com/openclaw/openclaw/commit/d9810811b6c3c9266d7580f00574e5e02f7663de patch
• https://www.vulncheck.com/advisories/openclaw-session-isolation-bypass-via-sessionid-resolution advisory pihak ketiga