CVE-2026-41298
CVE-2026-41298 · OpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes. Read-scoped callers can terminate running subagent sessions by sending requests to this endpoint, bypassing authorization controls.
CVSS 5.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-5hff-46vh-rxmw
- https://github.com/openclaw/openclaw/commit/54a0878517167c6e49900498cf77420dadb74beb
- https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-session-termination-endpoint
- https://nvd.nist.gov/vuln/detail/CVE-2026-41298