CVE-2026-34512: OpenClaw improper authz

CISO Take

CVE-2026-34512 is an authorization bypass in OpenClaw's HTTP session management API that allows any bearer-authenticated user — regardless of privilege level — to invoke the admin-only killSubagentRunAdmin function against sessions they do not own, with no scope validation enforced by the server. While OpenClaw has only 4 direct downstream dependents, the EPSS score (74th percentile) places this above the majority of the CVE population for near-term exploitation likelihood, and the combination of network accessibility, low attack complexity, and no required user interaction makes this trivially weaponizable by any credentialed insider or account-takeover victim. There is no public exploit and the vulnerability is not in CISA KEV, but the absence of a scope check means the exploitation path is a single authenticated HTTP request. Patch immediately to OpenClaw 2026.3.25; if patching is blocked, enforce admin-scoped token requirements on the /sessions/:sessionKey/kill endpoint at the API gateway and audit logs for unexpected cross-user session termination events.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 8.1 High with AV:N/AC:L/PR:L/UI:N represents a realistic and low-friction threat. Any authenticated user can escalate their effective privilege to admin level for session termination operations — a textbook broken access control (CWE-863) with no mitigating factors in the vector. EPSS at the 74th percentile indicates elevated exploitation likelihood relative to the broader CVE population, though absolute probability remains low (0.35%). Risk is most acute in multi-tenant OpenClaw deployments where multiple organizations or teams share a single instance, enabling cross-tenant session disruption. No active exploitation or KEV listing reduces immediate urgency, but low exploitation complexity means the window between patch availability and exploitation is short once attention is drawn to this advisory.

How does the attack unfold?

Initial Access

Attacker authenticates to OpenClaw with any valid low-privilege bearer token — obtained via legitimate access, phishing, or credential compromise.

AML.T0012

Session Discovery

Attacker enumerates or infers active session keys belonging to other users or operators via session listing endpoints, application logs, or observable error messages.

AML.T0084

Privilege Bypass

Attacker sends authenticated HTTP request to /sessions/:sessionKey/kill; server invokes killSubagentRunAdmin without validating admin scope or session ownership (CWE-863).

AML.T0049

Impact

Target subagent sessions are force-terminated, disrupting in-flight agent workflows, corrupting agentic pipeline state, and denying AI service to affected users or operators.

AML.T0029

Initial Access

Attacker authenticates to OpenClaw with any valid low-privilege bearer token — obtained via legitimate access, phishing, or credential compromise.

AML.T0012

Session Discovery

Attacker enumerates or infers active session keys belonging to other users or operators via session listing endpoints, application logs, or observable error messages.

AML.T0084

Privilege Bypass

Attacker sends authenticated HTTP request to /sessions/:sessionKey/kill; server invokes killSubagentRunAdmin without validating admin scope or session ownership (CWE-863).

AML.T0049

Impact

Target subagent sessions are force-terminated, disrupting in-flight agent workflows, corrupting agentic pipeline state, and denying AI service to affected users or operators.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

5 steps

Patch to OpenClaw >= 2026.3.25 immediately — see commit 02cf12371f93 for the fix.
If patching is blocked, restrict /sessions/:sessionKey/kill at the API gateway to require admin-scoped OAuth tokens; reject any request where the bearer token's scope does not include an explicit admin or operator claim.
Query application logs for session termination events where the requesting user's ID does not match the session owner's ID — these represent exploitation attempts or confirmed abuse.
Review all active bearer tokens issued with access to session management endpoints and scope-limit them pending patch deployment.
Consider a temporary WAF rule that validates session ownership before forwarding kill requests to the application layer.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Agent AML.T0012 - Valid Accounts AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2 - AI system design and security controls

NIST AI RMF

GOVERN 1.1 - Organizational policies and practices for AI risk

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-34512?

CVE-2026-34512 is an authorization bypass in OpenClaw's HTTP session management API that allows any bearer-authenticated user — regardless of privilege level — to invoke the admin-only killSubagentRunAdmin function against sessions they do not own, with no scope validation enforced by the server. While OpenClaw has only 4 direct downstream dependents, the EPSS score (74th percentile) places this above the majority of the CVE population for near-term exploitation likelihood, and the combination of network accessibility, low attack complexity, and no required user interaction makes this trivially weaponizable by any credentialed insider or account-takeover victim. There is no public exploit and the vulnerability is not in CISA KEV, but the absence of a scope check means the exploitation path is a single authenticated HTTP request. Patch immediately to OpenClaw 2026.3.25; if patching is blocked, enforce admin-scoped token requirements on the /sessions/:sessionKey/kill endpoint at the API gateway and audit logs for unexpected cross-user session termination events.

Is CVE-2026-34512 actively exploited?

No confirmed active exploitation of CVE-2026-34512 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-34512?

1. Patch to OpenClaw >= 2026.3.25 immediately — see commit 02cf12371f93 for the fix. 2. If patching is blocked, restrict /sessions/:sessionKey/kill at the API gateway to require admin-scoped OAuth tokens; reject any request where the bearer token's scope does not include an explicit admin or operator claim. 3. Query application logs for session termination events where the requesting user's ID does not match the session owner's ID — these represent exploitation attempts or confirmed abuse. 4. Review all active bearer tokens issued with access to session management endpoints and scope-limit them pending patch deployment. 5. Consider a temporary WAF rule that validates session ownership before forwarding kill requests to the application layer.

What systems are affected by CVE-2026-34512?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI agent platforms, AI orchestration systems, agentic pipelines.

What is the CVSS score for CVE-2026-34512?

CVE-2026-34512 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI agent platformsAI orchestration systemsagentic pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2

NIST AI RMF: GOVERN 1.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation. Attackers can exploit this by sending authenticated requests to kill arbitrary subagent sessions via the killSubagentRunAdmin function, bypassing ownership and operator scope restrictions.

Exploitation Scenario

A malicious insider or attacker who has compromised a low-privilege user account at an organization running a shared OpenClaw agent orchestration platform authenticates via a standard bearer token. They query a session listing endpoint or observe session keys from application logs or error messages to enumerate active subagent sessions belonging to other teams — for example, a nightly compliance evidence-gathering pipeline or a critical threat intelligence enrichment run scheduled before an audit. The attacker then sends a crafted authenticated HTTP request to /sessions/:sessionKey/kill for each target session. OpenClaw's server invokes killSubagentRunAdmin without validating that the requesting token has admin scope or owns the session, immediately terminating the target workflows. The attacker repeats the attack against any monitoring or audit agents to suppress detection, leaving affected teams to discover disrupted pipelines and corrupted in-progress outputs.

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.