CVE-2026-35657

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation. Attackers can access session history without proper operator read permissions by sending HTTP requests to the vulnerable endpoint.

Score

CVSS 4.0 7.1 High

Status

Analyzed - disclosure@vulncheck.com

Published

2026-04-10

Last modified

2026-06-23

Weaknesses

CWE-863

Affected products

• Openclaw (Openclaw)

References

• https://github.com/openclaw/openclaw/commit/1c45123231516fa50f8cf8522ba5ff2fb2ca7aea
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5jvj-hxmh-6h6j
• https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-http-session-history-route