N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-fwjq-xwfj-gv75

GHSA-fwjq-xwfj-gv75: OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations

Summary

session_status still bypasses configured tools.sessions.visibility for unsandboxed invocations

Current Maintainer Triage

Status: narrow
Normalized severity: medium
Assessment: Real on shipped v2026.3.22: non-sandboxed session_status skipped the shared visibility guard, but this is a same-agent session-policy bypass with unreleased fix, not a broader host-boundary break.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

4d369a3400dc9b737fbe8daa63f09d909ce7beb8 — 2026-03-30T16:48:12+02:00

Release Process Note

The fix is already present in released version 2026.3.31.
This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @tdjackey for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-fwjq-xwfj-gv75

GHSA-fwjq-xwfj-gv75:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-fwjq-xwfj-gv75, involves a bypass of session visibility controls in the session_status tool within the OpenClaw platform. By analyzing the provided fix commit 4d369a3400dc9b737fbe8daa63f09d909ce7beb8, I was able to pinpoint the exact location of the flaw.

The patch modifies the createSessionStatusTool function in src/agents/tools/session-status-tool.ts. The key change is the removal of a conditional statement that previously wrapped the visibilityGuard.check. Before the fix, this check was only triggered for sandboxed calls or when a session was looked up by its ID. This meant that for any unsandboxed call that specified a session key directly, the visibility check was skipped entirely, allowing a user to view session statuses that should have been restricted by the tools.sessions.visibility configuration.

The vulnerable function is therefore createSessionStatusTool, as it contained the flawed logic that failed to enforce authorization checks in all necessary cases. An attacker could exploit this by crafting a call to the session_status tool from within a non-sandboxed environment to illegitimately access information about other sessions.

Vulnerable functions

createSessionStatusTool

src/agents/tools/session-status-tool.ts

The `createSessionStatusTool` function was vulnerable because it did not properly enforce session visibility checks for unsandboxed tool invocations. The logic previously only performed a `visibilityGuard.check` if the session was resolved by its ID (`resolvedTargetViaSessionId`) or if the tool was explicitly sandboxed (`opts?.sandboxed === true`). This allowed an attacker in a non-sandboxed environment to bypass the intended session visibility restrictions (e.g., `self`) and access the status of other sessions by providing their session key, leading to an incorrect authorization vulnerability. The patch removes this conditional check, ensuring the visibility guard is applied to all invocations.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.