[openclaw] `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

**[openclaw] `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state**

Summary The built-in session_status tool did not enforce the intended session-visibility boundary. A sandboxed subagent could supply another session's sessionKey and inspect or modify state outside its own sandbox scope. Impact This allowed a sandboxed child session to read parent or sibling session data and, in affected releases, update the target session's persisted model override. Affected versions openclaw <= 2026.3.8 Patch Fixed in openclaw 2026.3.11 and included in later releases such as 2026.3.12. Session visibility checks now enforce the sandbox boundary before reading or mutating session state...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.