Privilege Escalation in OpenClaw Gateway Plugin by OpenClaw

CVE-2026-35645

What is CVE-2026-35645?

OpenClaw versions before 2026.3.25 are susceptible to a privilege escalation vulnerability found in the gateway plugin's deleteSession function. This issue allows attackers to manipulate session deletions without a request-scoped client, which can lead to executing privileged operations unintentionally. The exploitation of this vulnerability could give attackers unauthorized access to critical administrative functions, potentially compromising system integrity.

References