CVE-2026-35660

CVE-2026-35660 is an insufficient access control vulnerability affecting OpenClaw versions prior to 2026.3.23, specifically in the Gateway agent /reset endpoint. The flaw permits users with operator.write permissions to reset admin sessions and bypass operator.admin authorization requirements by invoking /reset or /new messages with an explicit sessionKey parameter, potentially allowing unauthorized session manipulation. The vulnerability carries a CVSS 3.1 score of 8.1 (HIGH) with a network-based attack vector requiring low complexity and low privileges. While no confidentiality impact exists, the flaw poses high integrity and availability risks through unauthorized session termination and administrative action bypass. The attack requires valid operator.write credentials but no user interaction. Exploitation status indicates this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and is not included on active public exploit lists. Community attention remains minimal, as reflected in the EPSS score of 0.00045, which is lower than 99.86% of all CVEs. Organizations should prioritize patching to version 2026.3.23 or later, particularly for systems where operator.write accounts may be less restricted than intended.