An insufficient access control vulnerability in OpenClaw allows authenticated attackers with limited privileges to reset arbitrary user sessions, posing a significant risk to administrative integrity.

This vulnerability resides in the Gateway agent /reset endpoint, where missing authorization checks fail to validate if the caller possesses the required operator.admin capability. Consequently, any attacker holding the lesser operator.write permission can supply an explicit sessionKey to reset administrative sessions.

The ability to reset arbitrary sessions allows an attacker to disrupt service availability and potentially facilitate account takeover scenarios if combined with other session-related flaws. With a CVSS score of 8.1, this high-severity vulnerability represents a serious threat to operational continuity and the integrity of administrative sessions within the affected environment.

Immediate Action: Upgrade the OpenClaw package to version 2026.3.23 or later to apply the necessary authorization checks in the Gateway agent.

Proactive Monitoring: Review system logs for frequent or irregular calls to the /reset or /new endpoints, particularly those associated with low-privileged accounts attempting to manipulate session keys.

Compensating Controls: Implement strict network access control lists to limit access to the Gateway agent endpoints to authorized management IP addresses only, reducing the attack surface.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized session manipulation, organizations should prioritize updating to version 2026.3.23. Administrators must verify that their current deployment is patched and that access controls for the Gateway agent are strictly enforced to prevent further abuse of privileged endpoints.