#VU125172 Improper access control in OpenClaw
Published: April 8, 2026
Vulnerability identifier: #VU125172
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
OpenClaw
OpenClaw
Software vendor:
OpenClaw
OpenClaw
Description
The vulnerability allows a remote user to reset administrative sessions.
The vulnerability exists due to improper access control in the Gateway agent RPC handler in src/gateway/server-methods/agent.ts when processing /reset or /new messages with an explicit sessionKey. A remote user can send a specially crafted RPC message to reset administrative sessions.
The issue occurs because this path does not enforce the operator.admin guard required by the direct sessions.reset RPC.
Remediation
Install security update from vendor's website.