Insufficient Access Control in OpenClaw Gateway Agent Allows Unauthorized Session Resets

CVE-2026-35660

What is CVE-2026-35660?

OpenClaw versions before 2026.3.23 are vulnerable to an insufficient access control flaw in the Gateway agent's /reset endpoint. This vulnerability allows attackers with operator.write permissions to reset admin sessions by exploiting the /reset or /new messages with a provided sessionKey. As a result, unauthorized users can bypass the intended operator.admin requirements, leading to security risks such as session hijacking and unauthorized access to administrative functionalities. Users and administrators are advised to apply the latest patches to secure their systems.

References