CVE-2026-32918 — OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the…

Key facts

CVE-2026-32918 is a High (8.4) vulnerability: OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

CVE	CVE-2026-32918
Severity	High (8.4)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-32918/

Details

CVE-2026-32918 is a High (8.4) vulnerability: OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.

Vulnerability Details

Property	Value
CVE ID	CVE-2026-32918
CVSS Score	8.4

Proof of Concept

Download

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-32918/poc.py

Usage

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start

# Clone and navigate to CVE directory
cd CVE-2026-32918

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-wcxr-59v9-rxr8
• https://www.vulncheck.com/advisories/openclaw-session-sandbox-escape-via-session-status-tool

---

Generated by PoC Generator on 2026-04-10T15:52:09.381843279

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-32918, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2026-32918 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any any (msg:"CVE-2026-32918 OpenClaw session sandbox escape attempt"; flow:to_server,established; content:"session_status"; nocase; content:"sessionKey"; distance:0; within:100; pcre:"/sessionKey\s*[:=]\s*['\"]?[^'\";\s&]{1,}/i"; classtype:attempted-admin; sid:1000000; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32918 OpenClaw arbitrary sessionKey manipulation"; flow:to_server,established; content:"sessionKey"; nocase; pcre:"/sessionKey\s*[:=]\s*['\"]?\.\.[\\/]|sessionKey\s*[:=]\s*['\"]?[\\/]|sessionKey\s*[:=]\s*['\"]?[a-fA-F0-9]{32,}/i"; classtype:attempted-admin; sid:1000001; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-32918 OpenClaw session data access outside sandbox"; flow:to_server,established; content:"session_status"; nocase; content:"sessionKey"; distance:0; within:200; content:"model"; distance:0; within:100; pcre:"/override|persist|parent|sibling/i"; classtype:attempted-admin; sid:1000002; rev:1; priority:2;)

alert tcp any any -> any any (msg:"CVE-2026-32918 OpenClaw session state manipulation attempt"; flow:to_server,established; content:"POST"; http_method; content:"session_status"; http_uri; content:"sessionKey"; http_client_body; pcre:"/sessionKey[^&]*[a-fA-F0-9]{16,}/i"; classtype:attempted-admin; sid:1000003; rev:1; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_32918_OpenClaw_Session_Sandbox_Escape {
    meta:
        author = "Security Engineer"
        description = "Detects OpenClaw session sandbox escape exploitation attempts (CVE-2026-32918)"
        cve = "CVE-2026-32918"
        date = "2024"
        severity = "high"

    strings:
        $session_tool1 = "session_status" ascii wide
        $session_tool2 = "session_status.exe" ascii wide
        $session_tool3 = "/session_status" ascii wide

        $sessionkey1 = "sessionKey" ascii wide nocase
        $sessionkey2 = "session_key" ascii wide nocase
        $sessionkey3 = "SessionKey" ascii wide

        $escape_pattern1 = "../" ascii wide
        $escape_pattern2 = "..\\" ascii wide
        $escape_pattern3 = "parent" ascii wide
        $escape_pattern4 = "sibling" ascii wide

        $sandbox_bypass1 = "sandbox" ascii wide nocase
        $sandbox_bypass2 = "subagent" ascii wide nocase

        $model_override1 = "model_override" ascii wide nocase
        $model_override2 = "modelOverride" ascii wide
        $model_override3 = "persisted_model" ascii wide nocase

        $session_access1 = "session.state" ascii wide nocase
        $session_access2 = "session_data" ascii wide nocase
        $session_access3 = "sessionState" ascii wide

        $openclaw_version = /OpenClaw\s+(1\.|2\.0\.|2026\.[0-2]\.|2026\.3\.[0-9]|2026\.3\.10)/ ascii wide

        $hex_sessionkey = { 73 65 73 73 69 6F 6E [1-10] 6B 65 79 }
        $hex_sandbox = { 73 61 6E 64 62 6F 78 }

    condition:
        (
            any of ($session_tool*) and 
            any of ($sessionkey*) and
            (
                any of ($escape_pattern*) or
                any of ($sandbox_bypass*) or
                any of ($model_override*) or
                any of ($session_access*)
            )
        ) or
        (
            $openclaw_version and
            (
                any of ($sessionkey*) or
                any of ($hex_*)
            ) and
            (
                any of ($escape_pattern*) or
                any of ($sandbox_bypass*)
            )
        ) or
        (
            any of ($hex_*) and
            any of ($escape_pattern*) and
            filesize < 10MB
        )
}

rule CVE_2026_32918_OpenClaw_Malicious_SessionKey_Injection {
    meta:
        author = "Security Engineer"
        description = "Detects malicious sessionKey injection patterns for OpenClaw sandbox escape"
        cve = "CVE-2026-32918"
        date = "2024"
        severity = "high"

    strings:
        $inject1 = /sessionKey\s*=\s*["'][^"']{32,}["']/ ascii wide
        $inject2 = /sessionKey\s*:\s*["'][^"']{32,}["']/ ascii wide
        $inject3 = /session_key\s*=\s*["'][^"']{32,}["']/ ascii wide

        $arbitrary1 = "arbitrary" ascii wide nocase
        $arbitrary2 = "crafted" ascii wide nocase
        $arbitrary3 = "malicious" ascii wide nocase

        $session_manipulation1 = "read_session" ascii wide nocase
        $session_manipulation2 = "modify_session" ascii wide nocase
        $session_manipulation3 = "access_session" ascii wide nocase

        $payload_marker1 = "<!CDATA[" ascii wide
        $payload_marker2 = "eval(" ascii wide
        $payload_marker3 = "exec(" ascii wide

    condition:
        (
            any of ($inject*) and
            (
                any of ($arbitrary*) or
                any of ($session_manipulation*) or
                any of ($payload_marker*)
            )
        ) or
        (
            2 of ($inject*) and
            filesize < 5MB
        )
}

rule CVE_2026_32918_OpenClaw_Session_State_Access {
    meta:
        author = "Security Engineer"
        description = "Detects unauthorized session state access patterns in OpenClaw"
        cve = "CVE-2026-32918"
        date = "2024"
        severity = "medium"

    strings:
        $state_access1 = "getSessionState" ascii wide nocase
        $state_access2 = "setSessionState" ascii wide nocase
        $state_access3 = "readSessionData" ascii wide nocase
        $state_access4 = "writeSessionData" ascii wide nocase

        $scope_bypass1 = "parent.session" ascii wide nocase
        $scope_bypass2 = "sibling.session" ascii wide nocase
        $scope_bypass3 = "global.session" ascii wide nocase

        $openclaw_binary = "openclaw" ascii wide nocase
        $openclaw_process = "openclaw.exe" ascii wide nocase

        $override_pattern1 = "override" ascii wide nocase
        $override_pattern2 = "overwrite" ascii wide nocase

    condition:
        (
            any of ($state_access*) and
            any of ($scope_bypass*)
        ) or
        (
            (
                $openclaw_binary or
                $openclaw_process
            ) and
            any of ($state_access*) and
            any of ($override_pattern*)
        )
}

:material-file-download: prevention/yara.yar

# CVE-2026-32918: OpenClaw Session Sandbox Escape Prevention
# Block malicious session_status tool requests and sessionKey manipulation

location ~* /session_status {
    # Block requests with suspicious sessionKey patterns
    if ($args ~* "sessionKey=.*\.\./") {
        return 403;
    }

    # Block attempts to access parent/sibling sessions via path traversal
    if ($args ~* "sessionKey=.*[\\/]\.\.[\\/]") {
        return 403;
    }

    # Block encoded path traversal attempts in sessionKey
    if ($args ~* "sessionKey=.*%2e%2e") {
        return 403;
    }
    if ($args ~* "sessionKey=.*%252e%252e") {
        return 403;
    }

    # Block sessionKey values with directory separators
    if ($args ~* "sessionKey=.*[\/\\]") {
        return 403;
    }

    # Block sessionKey attempts to access system paths
    if ($args ~* "sessionKey=.*(?:/etc|/proc|/sys|/var|/tmp|/usr|/opt)") {
        return 403;
    }

    # Block null bytes and control characters in sessionKey
    if ($args ~* "sessionKey=.*[\x00-\x1f\x7f]") {
        return 403;
    }

    # Limit sessionKey parameter length to prevent buffer overflow attempts
    if ($args ~* "sessionKey=.{256,}") {
        return 413;
    }

    # Block multiple sessionKey parameters
    if ($args ~* "sessionKey=.*&.*sessionKey=") {
        return 403;
    }

    # Add security headers
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Continue to backend if checks pass
    proxy_pass http://backend;
}

# Block direct access to session management endpoints
location ~* /(?:session|sandbox)_(?:override|persist|model) {
    # Block any access to session override/persistence endpoints
    return 403;
}

# General protection against session manipulation attempts
location ~* \.(php|jsp|asp|aspx)$ {
    # Block session-related parameter manipulation
    if ($args ~* "(?:session|sandbox)(?:Key|Id|Token)=.*[\./\\]") {
        return 403;
    }

    # Block model override attempts
    if ($args ~* "model.*override.*=") {
        return 403;
    }

    proxy_pass http://backend;
}

# Rate limiting for session_status endpoint
location = /session_status {
    limit_req zone=session_status burst=10 nodelay;
    limit_req_status 429;
}

# Define rate limiting zone (add to http block)
# limit_req_zone $binary_remote_addr zone=session_status:10m rate=5r/m;

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-32918 - OpenClaw Session Sandbox Escape
# Protects against unauthorized session access via sessionKey manipulation

# Rule 1000000: Block suspicious sessionKey parameter patterns
SecRule ARGS:sessionKey "@rx (?i)(\.\./|\.\.\\|%2e%2e%2f|%2e%2e\\|%252e%252e%252f)" \
    "id:1000000,\
    phase:2,\
    block,\
    severity:CRITICAL,\
    msg:'CVE-2026-32918: Potential session sandbox escape via directory traversal in sessionKey',\
    logdata:'sessionKey value: %{MATCHED_VAR}',\
    tag:'attack-traversal',\
    tag:'cve-2026-32918'"

# Rule 1000001: Block sessionKey values attempting to access parent sessions
SecRule ARGS:sessionKey "@rx (?i)(parent|\.\.|\^|root|admin|system)" \
    "id:1000001,\
    phase:2,\
    block,\
    severity:HIGH,\
    msg:'CVE-2026-32918: Suspicious sessionKey value attempting parent session access',\
    logdata:'sessionKey value: %{MATCHED_VAR}',\
    tag:'attack-session',\
    tag:'cve-2026-32918'"

# Rule 1000002: Restrict sessionKey format to expected patterns only
SecRule ARGS:sessionKey "!@rx ^[a-zA-Z0-9_-]{8,64}$" \
    "id:1000002,\
    phase:2,\
    block,\
    severity:MEDIUM,\
    msg:'CVE-2026-32918: Invalid sessionKey format detected',\
    logdata:'sessionKey value: %{MATCHED_VAR}',\
    tag:'attack-session',\
    tag:'cve-2026-32918'"

# Rule 1000003: Block requests to session_status tool with suspicious patterns
SecRule REQUEST_URI "@contains session_status" \
    "id:1000003,\
    phase:1,\
    chain,\
    severity:HIGH,\
    msg:'CVE-2026-32918: Blocked suspicious session_status request with malicious sessionKey',\
    logdata:'URI: %{REQUEST_URI}, sessionKey: %{ARGS.sessionKey}',\
    tag:'attack-session',\
    tag:'cve-2026-32918'"
SecRule ARGS:sessionKey "@rx (?i)(null|undefined|0x|\\x|%00|%0a|%0d)" \
    "block"

# Rule 1000004: Monitor and block excessive sessionKey enumeration attempts
SecRule ARGS:sessionKey "@unconditionalMatch" \
    "id:1000004,\
    phase:2,\
    pass,\
    severity:NOTICE,\
    setvar:'ip.session_attempts=+1',\
    expirevar:'ip.session_attempts=300',\
    tag:'tracking-session',\
    tag:'cve-2026-32918'"

SecRule IP:SESSION_ATTEMPTS "@gt 10" \
    "id:1000005,\
    phase:2,\
    block,\
    severity:WARNING,\
    msg:'CVE-2026-32918: Too many sessionKey attempts from IP - potential enumeration attack',\
    logdata:'Attempts: %{IP.SESSION_ATTEMPTS}',\
    tag:'attack-enum',\
    tag:'cve-2026-32918'"

# Rule 1000006: Block sessionKey values containing encoded special characters
SecRule ARGS:sessionKey "@rx (?i)(%2f|%5c|%00|%0a|%0d|%09|%20)" \
    "id:1000006,\
    phase:2,\
    block,\
    severity:MEDIUM,\
    msg:'CVE-2026-32918: Encoded special characters in sessionKey parameter',\
    logdata:'sessionKey value: %{MATCHED_VAR}',\
    tag:'attack-encoding',\
    tag:'cve-2026-32918'"

# Rule 1000007: Block sessionKey values that appear to target sibling sessions
SecRule ARGS:sessionKey "@rx (?i)(sibling|peer|other|next|prev|adjacent)" \
    "id:1000007,\
    phase:2,\
    block,\
    severity:HIGH,\
    msg:'CVE-2026-32918: sessionKey attempting to access sibling session data',\
    logdata:'sessionKey value: %{MATCHED_VAR}',\
    tag:'attack-session',\
    tag:'cve-2026-32918'"

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2026-32918?

CVE-2026-32918 is a High (8.4) vulnerability: OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32918?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32918?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

---

For authorized security testing and research only. See the full source and NVD record.