GHSA-9p93-7j67-5pc2

HIGH7.1

OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding

Published Mar 27, 2026

Modified 3 weeks ago

Details

Summary

Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding.

Details

The HTTP route previously treated any bearer-authenticated request as admin-eligible and could call without binding the action to requester ownership or caller-granted operator scopes. The flaw removes the bearer-token admin fallback and keeps remote session kills on the local-admin or requester-owned path only.

Affected Packages

openclaw

npm

References

ADVISORY

https://github.com/advisories/GHSA-9p93-7j67-5pc2

PACKAGE

https://github.com/openclaw/openclaw

WEB

https://github.com/openclaw/openclaw/commit/02cf12371f9353a16455da01cc02e6c4ecfc4152

WEB

https://github.com/openclaw/openclaw/security/advisories/GHSA-9p93-7j67-5pc2