CVE-2026-35660
Published: 10 April 2026
Summary
CVE-2026-35660 is a high-severity Missing Authorization (CWE-862) vulnerability in Openclaw Openclaw. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-35660 is an insufficient access control vulnerability (CWE-862) in OpenClaw versions before 2026.3.23. The flaw affects the Gateway agent's /reset endpoint, which improperly allows callers possessing operator.write permission to reset admin sessions, enabling bypass of operator.admin requirements.
Attackers with operator.write privileges can exploit this vulnerability over the network with low complexity and no user interaction by invoking /reset or /new messages with an explicit sessionKey. Successful exploitation resets arbitrary sessions, potentially disrupting administrative access and operations. The issue carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), reflecting high impacts on integrity and availability.
Mitigation requires upgrading to OpenClaw 2026.3.23 or later. Relevant patches are detailed in GitHub commits 50f6a2f136fed85b58548a38f7a3dbb98d2cd1a0 and 630f1479c44f78484dfa21bb407cbe6f171dac87, with further guidance in the GitHub Security Advisory GHSA-wq58-2pvg-5h4f and VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-insufficient-access-control-in-gateway-agent-session-reset.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21466
Vulnerability details
OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges can invoke /reset or /new messages with an explicit sessionKey to…
more
bypass operator.admin requirements and reset arbitrary sessions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The insufficient access control vuln in the network-accessible /reset endpoint allows lower-privilege (operator.write) callers to bypass admin requirements and reset sessions, directly enabling privilege escalation via vulnerability exploitation (T1068) and exploitation of public-facing applications (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 mandates enforcement of approved authorizations for access to system resources, directly preventing operator.write users from bypassing operator.admin requirements to reset sessions.
AC-6 enforces least privilege, ensuring only users with necessary operator.admin privileges can perform admin session resets.
SI-2 requires timely identification, reporting, and correction of flaws like this access control vulnerability via patching to OpenClaw 2026.3.23 or later.