PT-2026-31968 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-29 · Updated 2026-04-10 · CVE-2026-35657

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.25

Description The HTTP /sessions/:sessionKey/history route did not properly validate operator read permissions, allowing attackers to access session history without authorization. The issue occurred because the route authenticated bearer tokens but skipped the operator.read scope check used by the chat.history WebSocket endpoint. A commit (1c45123231516fa50f8cf8522ba5ff2fb2ca7aea) was introduced to require HTTP callers to declare operator scopes and reject history reads lacking operator.read permissions.

Recommendations Update to version 2026.3.25 or later.

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-863

Related Identifiers

CVE-2026-35657

GHSA-5JVJ-HXMH-6H6J

Affected Products

Openclaw

References · 7

• https://github.com/openclaw/openclaw/commit/1c45123231516fa50f8cf8522ba5ff2fb2ca7aea · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5jvj-hxmh-6h6j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35657 · Security Note
• https://osv.dev/vulnerability/GHSA-5jvj-hxmh-6h6j · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2042710256464134482 · Twitter Post
• https://vulncheck.com/advisories/openclaw-authorization-bypass-in-http-session-history-route · Note