Openclaw CVE-2026-41298

The attacker must possess valid authentication credentials (API token or user account) with at least read-scope permissions granted in the platform's RBAC configuration. The target OpenClaw instance must be using identity-bearing HTTP authentication modes (e.g., Bearer token or API key authentication) rather than alternative authentication schemes. The attacker must know or be able to enumerate the sessionKey of an active subagent session-this is not a blocker, as session keys may be discoverable through legitimate read-scope API endpoints or exposed in logs. The vulnerability does NOT require administrative privileges, non-standard configuration, or user interaction; it exploits the authorization bypass in the default session termination endpoint. Exploitation is limited by the need for prior authentication and the ability to identify valid session keys, but these are weak constraints in most operational environments where read-only API access is granted to multiple integrations or developers.

CVSS score of 5.3 reflects a Medium severity but with mitigating factors: the attack requires prior authentication (PR:L), network access (AV:N), low complexity (AC:L), and causes limited impact (VC:L, VI:L). The CVSS vector indicates confidentiality and integrity impacts are low, suggesting session termination disrupts availability of subagent sessions rather than exposing sensitive data. However, the practical risk is context-dependent. Within multi-tenant environments or platforms where read-only API keys are distributed to developers or integrations, this becomes a high-risk privilege escalation vector - an attacker with a compromised read-only token can maliciously terminate production sessions, causing denial of service. The absence from CISA KEV and lack of public POC suggest this has not yet seen widespread active exploitation, but the straightforward nature of the exploit (sending a POST request with existing credentials) means weaponization risk is moderate if the vulnerability becomes widely known. Organizations relying on read-only API scopes as a security boundary should treat this as high priority.

An attacker obtains a read-only API token from a compromised developer environment or legitimate third-party integration. Using only this token, the attacker crafts a POST request to https://openclaw.example.com/sessions/SESSIONKEY/kill, replacing SESSIONKEY with a known active session identifier (obtainable via the read-scoped /sessions endpoint). The request succeeds despite the token lacking write permissions, terminating the subagent session and disrupting dependent workflows. In a competitive or adversarial context, this could disrupt time-sensitive inference pipelines or batch processing jobs.