CVE-2026-34512

HIGH

OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint

Title source: cna
STIX 2.1

Description

OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. Attackers can exploit this by sending authenticated requests to kill arbitrary subagent sessions via the killSubagentRunAdmin function, bypassing ownership and operator scope restrictions.

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint
https://www.vulncheck.com/advisories/openclaw-improper-access-control-in-sessions-sessionkey-kill-endpoint
Third Party Advisory vendor-advisory
GitHub Security Advisory (GHSA-9p93-7j67-5pc2)
https://github.com/openclaw/openclaw/security/advisories/GHSA-9p93-7j67-5pc2

Scores

CVSS v3 8.1
EPSS 0.0035
EPSS Percentile 27.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-863
Status published
Products (3)
OpenClaw/OpenClaw < 2026.3.25
openclaw/openclaw < 2026.3.25
OpenClaw/OpenClaw 2026.3.25
Published Apr 09, 2026
Tracked Since Apr 10, 2026