The vulnerability allows remote actors to retrieve session history data without possessing the operator.read permission. By sending crafted HTTP requests to the /sessions/:sessionKey/history endpoint, an attacker can bypass the intended scope check and access potentially sensitive information from users’ sessions. This flaw gives an attacker unauthorized read access to data that should be protected by application‑level authorization controls.

OpenClaw deployments running any version older than 2026.3.25 are affected. The issue exists in the core application code prior to the 2026.3.25 release, regardless of the underlying operating system or host environment.

The flaw carries a CVSS score of 7.1, indicating a medium‑to‑high severity. No EPSS value is available and the vulnerability is not listed in the CISA KEV catalog, but it can be exploited over the network by sending unauthenticated or improperly scoped HTTP requests. The required conditions are minimal: access to the vulnerable endpoint and knowledge of a valid sessionKey. An attacker who can perform the request can read session history data without additional privileges.