CVE-2026-34512
HIGHOpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint
Title source: cnaDescription
OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. Attackers can exploit this by sending authenticated requests to kill arbitrary subagent sessions via the killSubagentRunAdmin function, bypassing ownership and operator scope restrictions.
Scores
CVSS v3
8.1
EPSS
0.0004
EPSS Percentile
12.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Details
CWE
CWE-863
Status
published
Products (3)
OpenClaw/OpenClaw
< 2026.3.25
openclaw/openclaw
< 2026.3.25
OpenClaw/OpenClaw
2026.3.25
Published
Apr 09, 2026
Tracked Since
Apr 10, 2026