Unauthorized Admin Access in OpenClaw: HTTP Session Kill Path Vulnerability
Summary
GHSA-9p93-7j67-5pc2: OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding. Affects openclaw versions < 2026.3.24. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed for managing and interacting with various web services through a unified API. It provides functionalities such as session management, user authentication, and remote command execution. However, a recent vulnerability has been identified that allows unauthorized access to admin-level functions, specifically through the HTTP route for killing sessions.
Vulnerability Detail
The vulnerability arises from a flaw in the HTTP route '/sessions/:sessionKey/kill', which previously allowed any bearer-authenticated request to be treated as admin-eligible. This means that an attacker could potentially exploit this route to terminate sessions without proper authorization checks, leading to unauthorized access and control over user sessions. The flaw stems from the absence of caller scope binding, which should restrict access to only those actions that the requester owns or has been granted permission to perform. The implications of this vulnerability are significant, as it could lead to session hijacking and unauthorized administrative actions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is recommended to restrict access to the '/sessions/:sessionKey/kill' route to only local-admin users or those who own the session. This can be done by implementing additional authorization checks in the application code to ensure that only authorized users can perform session termination actions.
Conclusion
In summary, the OpenClaw package has a significant vulnerability that allows unauthorized access to admin functionalities through a specific HTTP route. It is crucial for users to update to the latest version to mitigate this risk and implement temporary workarounds if immediate updates are not feasible.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows unauthorized admin access through the HTTP session kill path, enabling attackers to terminate sessions without proper authorization.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
If you cannot update the package immediately, implement additional authorization checks to restrict access to the vulnerable route as a temporary measure.
More information about OpenClaw can be found on its official GitHub repository and documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
