| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
The chat.send path reused command authorization to trigger /reset session rotation even though direct session reset is an admin-only control-plane operation.
A write-scoped gateway caller could rotate a target session, archive the prior transcript state, and force a new session id without admin scope.
src/gateway/server-methods/chat.ts, src/auto-reply/reply/session.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit be00fcfccb (Gateway: align chat.send reset scope checks).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free