High
OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint
Type: advisorySources: OSV
OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. Attackers can exploit this by sending authenticated requests to kill arbitrary subagent sessions via the killSubagentRunAdmin function, bypassing ownership and operator scope restrictions.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-34512
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 06:00 UTC · Revision 1
Source evidence
OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint
core-osv · Original sourcePublished 9 Apr 2026, 21:26 UTC
OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. Attackers can exploit this by sending authenticated requests to kill arbitrary subagent sessions via the killSubagentRunAdmin function, bypassing ownership and operator scope restrictions.
osv:CVE-2026-34512
Complete source record
{
"id": "ad78af1efa848cbf624c9f6319e203341a0e554da950a87c914286023b5b0f1b",
"url": "https://osv.dev/vulnerability/CVE-2026-34512",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint",
"summary": "OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. Attackers can exploit this by sending authenticated requests to kill arbitrary subagent sessions via the killSubagentRunAdmin function, bypassing ownership and operator scope restrictions.",
"evidence": "osv:CVE-2026-34512",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-34512",
"aliases": [
"CVE-2026-34512",
"GHSA-9p93-7j67-5pc2"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openclaw/openclaw",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "02cf12371f9353a16455da01cc02e6c4ecfc4152"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "02cf12371f9353a16455da01cc02e6c4ecfc4152"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2026.3.24",
"v2026.3.24-beta.2",
"v2026.3.24-beta.1",
"v2026.3.23-2",
"v2026.3.23",
"v2026.3.23-beta.1",
"v2026.3.22",
"v2026.3.22-beta.1",
"v2026.3.13-1",
"v2026.3.13",
"v2026.3.12",
"v2026.3.11",
"v2026.3.11-beta.1",
"v2026.3.8",
"v2026.3.8-beta.1",
"v2026.3.7",
"v2026.3.7-beta.1",
"v2026.3.2-beta.1",
"v2026.3.2",
"v2026.3.1",
"v2026.2.26",
"v2026.2.26-beta.1",
"v2026.2.25",
"v2026.2.25-beta.1",
"v2026.2.24",
"v2026.2.24-beta.1",
"v2026.2.23",
"v2026.2.23-beta.1",
"v2026.2.22",
"v2026.2.22-beta.1",
"v2026.2.21",
"v2026.2.21-beta.1",
"v2026.2.19-beta.1",
"v2026.2.19",
"v2026.2.17",
"v2026.2.15-beta.1",
"v2026.2.14",
"v2026.2.13",
"v2026.2.12",
"v2026.2.9",
"v2026.2.6-3",
"v2026.2.6-2",
"v2026.2.6-1",
"v2026.2.6",
"v2026.2.3",
"v2026.2.2",
"v2026.2.1",
"v2026.1.30",
"v2026.1.29",
"v2026.1.24-1",
"v2026.1.24",
"v2026.1.23",
"v2026.1.22",
"v2026.1.21",
"v2026.1.20",
"v2026.1.16-2",
"v2026.1.15",
"v2026.1.14-1",
"v2026.1.13",
"v2026.1.12-2",
"v2026.1.12",
"v2026.1.11-3",
"v2026.1.11-2",
"v2026.1.11-1",
"v2026.1.11",
"v2026.1.10",
"v2026.1.9",
"v2026.1.8",
"v2026.1.5-3",
"v2026.1.5-2",
"v2026.1.5-1",
"v2026.1.5",
"v2.0.0-beta5",
"v2.0.0-beta4",
"v2.0.0-beta3",
"v2.0.0-beta2",
"v2.0.0-beta1",
"v1.3.0",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.0",
"v1.0.4",
"v0.1.3",
"v0.1.2",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34512.json"
}
}
],
"modified": "2026-10-28T02:30:43.253039146Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34512.json",
"https://github.com/openclaw/openclaw/security/advisories/GHSA-9p93-7j67-5pc2",
"https://nvd.nist.gov/vuln/detail/CVE-2026-34512",
"https://www.vulncheck.com/advisories/openclaw-improper-access-control-in-sessions-sessionkey-kill-endpoint",
"https://github.com/openclaw/openclaw/commit/02cf12371f9353a16455da01cc02e6c4ecfc4152"
],
"provider_metadata": {
"cwe_ids": [
"CWE-863"
],
"cna_assigner": "VulnCheck",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "2026.3.25"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
},
{
"extracted_events": [
{
"range": [
{
"fixed": "2026.3.25"
}
],
"source": "CPE_FIELD",
"strategy": "CPEApplicability"
}
]
},
{
"extracted_events": [
{
"range": [
{
"fixed": "2026.3.25"
}
],
"source": "DESCRIPTION"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34512.json"
}
},
"related_cves": [
{
"value": "CVE-2026-34512",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 510912,
"published_at": "2026-04-09T21:26:50.015+00:00"
}