CVE-2026-35660
OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset
概要
OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges can invoke /reset or /new messages with an explicit sessionKey to bypass operator.admin requirements and reset arbitrary sessions.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com
- patch github.com