PT-2026-30774 · Npm · Openclaw

Published 2026-03-27 · Updated 2026-03-27

OSV

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Summary

Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding.

Details

The HTTP route previously treated any bearer-authenticated request as admin-eligible and could call without binding the action to requester ownership or caller-granted operator scopes. The flaw removes the bearer-token admin fallback and keeps remote session kills on the local-admin or requester-owned path only.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-226

Related Identifiers

GHSA-9P93-7J67-5PC2

Affected Products

Openclaw

References · 4

• https://osv.dev/vulnerability/GHSA-9p93-7j67-5pc2 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9p93-7j67-5pc2 · Note
• https://github.com/openclaw/openclaw/commit/02cf12371f9353a16455da01cc02e6c4ecfc4152 · Note