{"id":"CVE-2026-34512","aliases":["GHSA-9p93-7j67-5pc2"],"url":"https://o3.security/vulnerability/CVE-2026-34512","summary":"OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint","details":"## Summary\n\nGateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding.\n\n## Details\n\nThe HTTP route previously treated any bearer-authenticated request as admin-eligible and could call without binding the action to requester ownership or caller-granted operator scopes. The flaw removes the bearer-token admin fallback and keeps remote session kills on the local-admin or requester-owned path only.","published":"2026-04-09T21:26:50.015Z","modified":"2026-10-21T02:56:54.909829781Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"openclaw","fixedVersion":null}],"fix":{"url":"https://github.com/openclaw/openclaw/commit/02cf12371f9353a16455da01cc02e6c4ecfc4152","label":"openclaw/openclaw@02cf123"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34512.json"},{"type":"ADVISORY","url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9p93-7j67-5pc2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34512"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openclaw-improper-access-control-in-sessions-sessionkey-kill-endpoint"},{"type":"FIX","url":"https://github.com/openclaw/openclaw/commit/02cf12371f9353a16455da01cc02e6c4ecfc4152"},{"type":"PACKAGE","url":"https://github.com/openclaw/openclaw"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:56:54.909829781Z"}}