GHSA-5jvj-hxmh-6h6j

Suggest an improvement
Source
https://github.com/advisories/GHSA-5jvj-hxmh-6h6j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5jvj-hxmh-6h6j/GHSA-5jvj-hxmh-6h6j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5jvj-hxmh-6h6j
Aliases
  • CVE-2026-35657
Downstream
Published
2026-03-29T15:46:40Z
Modified
2026-04-10T17:34:04.837947Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope
Details

Summary

Gateway HTTP Session History Route Bypasses Operator Read Scope

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

The HTTP /sessions/:sessionKey/history route previously authenticated bearer tokens but skipped the same operator.read check used by chat.history over WebSocket. Commit 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea makes HTTP callers declare operator scopes and rejects history reads that do not include operator.read.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea.

Fix Commit(s)

  • 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea
Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-29T15:46:40Z",
    "cwe_ids": [
        "CWE-639",
        "CWE-863"
    ],
    "severity": "MODERATE",
    "nvd_published_at": null
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.3.25

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5jvj-hxmh-6h6j/GHSA-5jvj-hxmh-6h6j.json"
last_known_affected_version_range 
"<= 2026.3.24"