Openclaw cli: OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations (CVE-2026-41350)

CVE-2026-41350 in the Openclaw CLI involves the `session_status` command bypassing the configured `tools.sessions.visibility` guard when invoked without sandboxing. This results in a same-agent session-policy bypass, meaning that visibility restrictions intended to limit session information exposure are circumvented within the same agent context. The issue does not extend to broader host-level boundary violations. The vulnerability affects Openclaw CLI versions from 2026.1.29 up to but not including 2026.3.31. The fix was introduced in version 2026.3.31, with the relevant commit dated 2026-03-30.

An attacker or user operating within the same agent context can bypass session visibility restrictions configured by `tools.sessions.visibility` when using the `session_status` command without sandboxing. This could lead to unauthorized access to session information within the same agent environment. There is no indication of privilege escalation or host boundary compromise. No known exploits are reported in the wild.

Upgrade Openclaw CLI to version 2026.3.31 or later, which contains the official fix for this vulnerability. Users running versions prior to 2026.3.31 should apply this update to prevent the session-policy bypass. No additional mitigation steps are indicated by the vendor.