CVE-2026-34512: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-34512 is an improper access control vulnerability (CWE-863) in OpenClaw, a Node.js package, affecting all versions before 2026.3.25. The flaw exists in the HTTP /sessions/:sessionKey/kill route, which allowed any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. The vulnerability was published on April 9, 2026, with a patch released as version 2026.3.25. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.2 (High) (Github Advisory, OpenClaw Advisory).

The root cause is incorrect authorization (CWE-863) and incorrect privilege assignment (CWE-266) in the session-kill-http.ts gateway handler. The vulnerable code contained a canBearerTokenKillSessions() function that treated any authenticated bearer token as carrying ADMIN_SCOPE and WRITE_SCOPE operator privileges, allowing it to call killSubagentRunAdmin() without verifying that the requester owned or was granted operator scope over the target session. The fix (commit 02cf123) removes the bearer-token admin fallback entirely, restricting remote session kills to local-admin requests or sessions where the requester holds verified ownership, and now returns HTTP 403 for unauthorized attempts (OpenClaw Advisory, Patch Commit).

Successful exploitation allows any low-privileged, bearer-authenticated user to terminate arbitrary subagent sessions belonging to other users or operators, bypassing ownership and scope restrictions. This results in high integrity and availability impact — attackers can disrupt service operations, cause loss of in-progress work, and interfere with subagent orchestration workflows. There is no confidentiality impact, as the vulnerability does not expose data, and subsequent system impact is not affected (Github Advisory, OpenClaw Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires only low-privilege bearer token authentication and no user interaction, making it straightforward to exploit for any authenticated user of an affected OpenClaw deployment. The EPSS score is approximately 0.034–0.047%, placing it in the lower percentiles for near-term exploitation likelihood. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, OpenClaw Advisory).

1. Obtain a valid bearer token: Authenticate to the target OpenClaw instance using any valid user account to obtain a bearer token — no elevated privileges are required.
2. Enumerate active sessions: Identify target subagent session keys (e.g., agent:main:subagent:worker) through normal API usage, logs, or by observing session key patterns in the application.
3. Craft the kill request: Send an HTTP POST request to /sessions/<URL-encoded-sessionKey>/kill with the bearer token in the Authorization header (e.g., Authorization: Bearer <token>).
4. Trigger unauthorized admin kill: On vulnerable versions (≤ 2026.3.24), the canBearerTokenKillSessions() function grants the request ADMIN_SCOPE, causing killSubagentRunAdmin() to be invoked and terminating the target session regardless of ownership.
5. Achieve service disruption: Repeat for additional session keys to terminate arbitrary subagent sessions across the platform, disrupting operations for other users or operators (OpenClaw Advisory, Patch Commit).

• Network: Repeated HTTP POST requests to /sessions/<sessionKey>/kill endpoints originating from non-administrative users or unexpected source IPs; requests lacking the x-openclaw-requester-session-key header but carrying a bearer token.
• Logs: OpenClaw gateway access logs showing HTTP 200 responses to /sessions/*/kill from bearer-authenticated users who do not own the targeted sessions; unusual volume of session kill events in a short time window.
• Application Behavior: Unexpected termination of subagent sessions not initiated by their owners or local admins; multiple sessions across different operators being killed in rapid succession.

Upgrade OpenClaw to version 2026.3.25 or later, which removes the bearer-token admin fallback and restricts session kills to local-admin requests or verified requester-owned sessions (OpenClaw Advisory, Patch Commit). As a temporary workaround prior to patching, implement network-level access controls (e.g., firewall rules or API gateway policies) to restrict access to the /sessions/:sessionKey/kill endpoint to trusted administrative IP ranges only. Additionally, monitor session management logs for anomalous session termination activity to detect potential abuse.

The vulnerability was reported by security researcher zpbrent and the advisory was published by steipete on the OpenClaw GitHub repository. The CVE was assigned by VulnCheck and appeared in CISA's weekly vulnerability bulletin (SB26-103) for the week of April 6, 2026. Coverage was noted on RedPacket Security and briefly mentioned on Mastodon security feeds, but no significant broader media or researcher commentary has been identified (OpenClaw Advisory).