CVE-2026-34512CWE-863

OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint

High · published April 9, 2026

CVSS v4.0
7.2
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. Attackers can exploit this by sending authenticated requests to kill arbitrary subagent sessions via the killSubagentRunAdmin function, bypassing ownership and operator scope restrictions.

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-04-09T21:26Z
EPSS history
Timeline
  • 09 APR 21:26Z
    OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint
    cvelistv5