CVE-2026-35657
OpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route
Résumé
OpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation. Attackers can access session history without proper operator read permissions by sending HTTP requests to the vulnerable endpoint.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com