PT-2026-32062 · Npm · Openclaw

Published 2026-04-01 · Updated 2026-04-01

OSV

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Summary

The chat.send path reused command authorization to trigger /reset session rotation even though direct session reset is an admin-only control-plane operation.

Impact

A write-scoped gateway caller could rotate a target session, archive the prior transcript state, and force a new session id without admin scope.

Affected Component

src/gateway/server-methods/chat.ts, src/auto-reply/reply/session.ts

Fixed Versions

• Affected: <= 2026.3.24
• Patched: >= 2026.3.28
• Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit be00fcfccb (Gateway: align chat.send reset scope checks).

Fix

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

GHSA-5R8F-96GM-5J6G

Affected Products

Openclaw

References · 5

• https://osv.dev/vulnerability/GHSA-5r8f-96gm-5j6g · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5r8f-96gm-5j6g · Note
• https://github.com/openclaw/openclaw/commit/be00fcfccba108f88dc3d4380146c6e058770b03 · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.28 · Note