OpenClaw Authorization Bypass Vulnerability in HTTP Session History Route

A vulnerability allowing authorization bypass has been identified in OpenClaw versions prior to 2026.3.25. The issue resides in the HTTP '/sessions/:sessionKey/history' route, where the 'operator.read' scope validation is skipped. This allows attackers to access session history without the necessary permissions by sending requests to the affected endpoint.

Impact

Exploitation of this vulnerability allows unauthorized access to session history, bypassing the required 'operator.read' permissions.

Reproduction

The vulnerability can be reproduced by sending an HTTP request to the '/sessions/:sessionKey/history' endpoint without including the 'operator.read' scope in the request headers. This can be done using a tool like Postman or curl, by omitting the necessary authorization scope while still providing a valid bearer token.

Remediation

Users can update to OpenClaw version 2026.3.25 or later to address this vulnerability.