PT-2026-32062 · Npm · Openclaw

Publicado 2026-04-01 · Atualizado 2026-04-01

OSV

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Summary

The chat.send path reused command authorization to trigger /reset session rotation even though direct session reset is an admin-only control-plane operation.

Impact

A write-scoped gateway caller could rotate a target session, archive the prior transcript state, and force a new session id without admin scope.

Affected Component

src/gateway/server-methods/chat.ts, src/auto-reply/reply/session.ts

Fixed Versions

• Affected: <= 2026.3.24
• Patched: >= 2026.3.28
• Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit be00fcfccb (Gateway: align chat.send reset scope checks).

Correção

Improper Access Control

Incorrect Authorization

Enumeração de Fraquezas

CWE-284

CWE-863

Identificadores relacionados

GHSA-5R8F-96GM-5J6G

Produtos afetados

Openclaw

Referências · 5

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5r8f-96gm-5j6g · Nota
• https://github.com/openclaw/openclaw/commit/be00fcfccba108f88dc3d4380146c6e058770b03 · Nota
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.28 · Nota
• https://osv.dev/vulnerability/GHSA-5r8f-96gm-5j6g · Aviso do Fabricante