PT-2026-33865

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.2 Description In identity-bearing HTTP modes, the software fails to enforce write scopes on the 'POST /sessions/:sessionKey/kill' endpoint. This authorization flaw allows callers with read-only operator scopes...