An improper access control flaw in OpenClaw allows authenticated users to perform unauthorized administrative session terminations, posing a significant risk to operational integrity.

The vulnerability exists within the HTTP /sessions/:sessionKey/kill route, where the killSubagentRunAdmin function fails to perform adequate scope validation. This allows any bearer-authenticated user to terminate arbitrary subagent sessions by bypassing intended ownership and operator restrictions.

The ability for unauthorized users to terminate active sessions can lead to significant service disruption and denial of service for legitimate operators. Given the CVSS score of 8.1, this represents a high-severity risk to business continuity, as it allows standard users to perform administrative actions that impact the stability and management of the platform.

Immediate Action: Update the OpenClaw package to version 2026.3.25 or later to apply the necessary authorization checks.

Proactive Monitoring: Review access logs for suspicious patterns of session termination requests, particularly those originating from user accounts that should not possess administrative privileges.

Compensating Controls: Implement strict network-level access controls or a Web Application Firewall (WAF) to restrict access to sensitive administrative endpoints to authorized IP addresses only.

Public Exploit Available: No.

This vulnerability highlights a critical failure in authorization logic that directly impacts administrative control. Administrators should prioritize upgrading to version 2026.3.25 immediately to ensure that scope validation is correctly enforced and to prevent unauthorized disruption of subagent sessions.