Medium severity4.3NVD Advisory· Published Jun 12, 2026· Updated Jun 16, 2026

CVE-2026-53826

Description

OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exploit this by spawning child sessions from sandboxed parents to reveal host workspace location or related memory context to child models.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenClaw/Openclaw2 versions
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.4.26
- (no CPE)range: <2026.4.26

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/security/advisories/GHSA-6c4r-g249-wv3cnvdMitigationVendor Advisory
www.vulncheck.com/advisories/openclaw-information-disclosure-via-sandboxed-session-spawnnvdThird Party Advisory

News mentions

OpenClaw: 25 CVEs Disclosed in Largest Security Batch, Including Code Execution and Critical Auth Bypass
Vypr Intelligence · Jun 12, 2026

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000