CVE-2026-32918 OpenClaw 会话沙盒逃逸漏洞：会话数据

OpenClaw 中的 CVE-2026-32918 影响了内部工具 session_status，该工具没有正确执行会话可见性边界。沙盒化的子代理可以提供另一个会话的 sessionKey，并检查或修改其自身沙盒范围之外的状态。这构成了一个重大的安全风险，因为恶意子代理可能会访问敏感信息或更改其他会话的行为。

Applications and services relying on openclaw for sandboxing and session management are at risk. This includes systems where subagents are used to extend the functionality of the main application, particularly those handling sensitive user data or financial transactions. Organizations using legacy openclaw configurations or those with limited resources for timely patching are particularly vulnerable.

• nodejs:

  npm list openclaw

This command will list installed openclaw versions. Check if the version is <= 2026.3.8. • nodejs:

  find / -name "openclaw*" -type d -print

This command searches for openclaw related directories, which may indicate installation locations. • generic web: Review openclaw logs for unusual session activity or attempts to access data outside the expected scope. Look for patterns indicative of a sandboxed subagent attempting to access other session keys.

1. 2026-03-13Disclosure

   disclosure

1. 已保留2026-03-16
2. 发布日期2026-03-13
3. 修改日期2026-04-01
4. EPSS 更新日期2026-04-06

为了减轻这种风险，建议将 OpenClaw 更新到 2026.3.11 或更高版本。此版本包含一个修复程序，可以加强会话可见性边界的执行，从而防止未经授权访问其他会话的数据。此外，请审查沙盒化子代理的配置，以确保它们仅访问其操作所需的资源，从而最大限度地减少攻击面。更新是最有效的解决方案，并强烈建议。