GitHub Advisoryadvisory · npm

GHSA-9p93-7j67-5pc2 OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding

HIGH Published 2026-03-27 Modified 2026-03-27 Official page ↗
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-226, CWE-863
Reviewed
2026-03-27

Affected packages

• npm openclaw: <= 2026.3.24 (no fix yet)

Description

Summary Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding. Details The HTTP route previously treated any bearer-authenticated request as admin-eligible and could call without binding the action to requester ownership or caller-granted operator scopes. The flaw removes the bearer-token admin fallback and keeps remote session kills on the local-admin or requester-owned path only.

Related

Weakness · CWE (2)

  • CWE-226 Sensitive Information in Resource Not Removed Before Reuse weakness
  • CWE-863 Incorrect Authorization weakness

References