CVE-2026-32919
CVE-2026-32919 · OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash Commands
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic. Attackers with operator.write scope can issue agent requests containing /new or /reset slash commands to reset targeted conversation state without holding operator.admin privileges.
CVSS 6.9 · Media · EPSS 0,1% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node