Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-35657
6.5 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): NONE
- Availability impact (A): NONE
OpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation. Attackers can access session history without proper operator read permissions by sending HTTP requests to the vulnerable endpoint.
References
-
GitHub Security Advisory (GHSA-5jvj-hxmh-6h6j) third-party-advisory
-
Patch Commit patch
Affected products
OpenClaw
- <2026.3.25
- ==2026.3.25
Package maintainers
-
@mkg20001 Maciej Krüger <mkg20001+nix@gmail.com>
-
@chrisportela Chris Portela <chris@chrisportela.com>