CVE-2026-35660
CVE-2026-35660 · OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges can invoke /reset or /new messages with an explicit sessionKey to bypass operator.admin requirements and reset arbitrary sessions.
CVSS 7.2 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-wq58-2pvg-5h4f
- https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
- https://github.com/openclaw/openclaw/commit/50f6a2f136fed85b58548a38f7a3dbb98d2cd1a0
- https://www.vulncheck.com/advisories/openclaw-insufficient-access-control-in-gateway-agent-session-reset
- https://nvd.nist.gov/vuln/detail/CVE-2026-35660