OpenClaw before 2026.3.23 has an insufficient access control flaw in the Gateway agent /reset endpoint that permits callers who hold operator.write permissions to reset admin sessions. This capability undermines the integrity of privileged sessions and can lead to denial of service for administrators or unauthorized manipulation of session state, compromising the availability and trust of the system.

The affected product is OpenClaw with all releases prior to 2026.3.23. No additional vendors or product versions are mentioned in the advisory.

The CVSS score of 7.2 signals a high severity risk, while the EPSS score is unavailable and the vulnerability is not listed in the KEV catalog, indicating limited known exploitation. Attackers must first obtain operator.write privileges; once achieved, they may use the /reset or /new endpoints with an explicit sessionKey to bypass the required operator.admin role and reset any session. The likely attack vector is through the authenticated /reset API endpoint, requiring user authentication and appropriate role elevation.