GHSA-9p93-7j67-5pc2: OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding

March 27, 2026

Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding.

References

github.com/advisories/GHSA-9p93-7j67-5pc2
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/02cf12371f9353a16455da01cc02e6c4ecfc4152
github.com/openclaw/openclaw/security/advisories/GHSA-9p93-7j67-5pc2

Code Behaviors & Features

Detect and mitigate GHSA-9p93-7j67-5pc2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →