PT-2026-30774 · Npm · Openclaw

Publicado 2026-03-27 · Atualizado 2026-03-27

OSV

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Summary

Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding.

Details

The HTTP route previously treated any bearer-authenticated request as admin-eligible and could call without binding the action to requester ownership or caller-granted operator scopes. The flaw removes the bearer-token admin fallback and keeps remote session kills on the local-admin or requester-owned path only.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

CWE-226

Identificadores relacionados

GHSA-9P93-7J67-5PC2

Produtos afetados

Openclaw

Referências · 4

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/commit/02cf12371f9353a16455da01cc02e6c4ecfc4152 · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9p93-7j67-5pc2 · Nota
• https://osv.dev/vulnerability/GHSA-9p93-7j67-5pc2 · Aviso do Fabricante