CVE-2026-35657
CVE-2026-35657 · OpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation. Attackers can access session history without proper operator read permissions by sending HTTP requests to the vulnerable endpoint.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-5jvj-hxmh-6h6j
- https://github.com/openclaw/openclaw/commit/1c45123231516fa50f8cf8522ba5ff2fb2ca7aea
- https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-http-session-history-route
- https://nvd.nist.gov/vuln/detail/CVE-2026-35657