GHSA-5r8f-96gm-5j6g

Details

Summary

The chat.send path reused command authorization to trigger /reset session rotation even though direct session reset is an admin-only control-plane operation.

Impact

A write-scoped gateway caller could rotate a target session, archive the prior transcript state, and force a new session id without admin scope.

Affected Component

src/gateway/server-methods/chat.ts, src/auto-reply/reply/session.ts

Fixed Versions

Affected: <= 2026.3.24
Patched: >= 2026.3.28
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit be00fcfccb (Gateway: align chat.send reset scope checks).

Affected Packages

openclaw

npm

Fixed in:

2026.3.28

References

ADVISORY

https://github.com/advisories/GHSA-5r8f-96gm-5j6g

PACKAGE

https://github.com/openclaw/openclaw

WEB

https://github.com/openclaw/openclaw/commit/be00fcfccba108f88dc3d4380146c6e058770b03

WEB

https://github.com/openclaw/openclaw/releases/tag/v2026.3.28

WEB

https://github.com/openclaw/openclaw/security/advisories/GHSA-5r8f-96gm-5j6g