PT-2026-31363 · Npm · Openclaw

Publicado 2026-03-29 · Atualizado 2026-03-29

OSV

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

Gateway Plugin Subagent Fallback deleteSession Uses Synthetic operator.admin

Affected Packages / Versions

• Package: openclaw
• Affected versions: <= 2026.3.24
• First patched version: 2026.3.25
• Latest published npm version at verification time: 2026.3.24

Details

Gateway plugin subagent fallback deleteSession previously dispatched sessions.delete with a synthetic operator.admin runtime scope when no request-scoped client existed. Commit b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7 binds deletion to the caller scope instead of minting admin scope.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7.

Fix Commit(s)

• b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7

Correção

Incorrect Privilege Assignment

Incorrect Authorization

Enumeração de Fraquezas

CWE-266

CWE-648

CWE-863

Identificadores relacionados

GHSA-H4JX-HJR3-FHGC

Produtos afetados

Openclaw

Referências · 6

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-h4jx-hjr3-fhgc · Nota
• https://github.com/openclaw/openclaw/commit/b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-35645 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-h4jx-hjr3-fhgc · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-privilege-escalation-via-synthetic-operator-admin-in-deletesession · Nota