OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope

TRUNG BÌNH 6.5CVE-2026-35657 · GHSA-5jvj-hxmh-6h6j · Công bố 10/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-35657 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.23%, cao hơn 14.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.3.25 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`< 2026.3.25`	`2026.3.25`
openclaw npm	`< 2026.3.25`	`2026.3.25`

Mô tả

Summary

Gateway HTTP Session History Route Bypasses Operator Read Scope

Affected Packages / Versions

Package: openclaw
Affected versions: <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

The HTTP /sessions/:sessionKey/history route previously authenticated bearer tokens but skipped the same operator.read check used by chat.history over WebSocket. Commit 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea makes HTTP callers declare operator scopes and rejects history reads that do not include operator.read.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea.

Fix Commit(s)

1c45123231516fa50f8cf8522ba5ff2fb2ca7aea

Mô tả của NVD

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation. Attackers can access session history without proper operator read permissions by sending HTTP requests to the vulnerable endpoint.