CVE-2026-35660
OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset
Summary
OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset
Original description
The description as published by the source.
OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges can invoke /reset or /new messages with an explicit sessionKey to bypass operator.admin requirements and reset arbitrary sessions.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com
- patch github.com