What is GHSA-5hff-46vh-rxmw?

GHSA-5hff-46vh-rxmw is a security advisory published by GitHub Security Advisories with Medium severity. OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

Which CVE IDs does GHSA-5hff-46vh-rxmw cover?

GHSA-5hff-46vh-rxmw covers the following CVE IDs: CVE-2026-41298. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5hff-46vh-rxmw?

GHSA-5hff-46vh-rxmw has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-5hff-46vh-rxmw?

GHSA-5hff-46vh-rxmw affects 1 product, including: npm/openclaw:\u003c= 2026.4.1.

GHSA-5hff-46vh-rxmwMediumCVSS 5.4

OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

Vendor

GitHub Security Advisories

Published

April 7, 2026

Last Modified

April 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-41298 →

📋 Description

Summary

Before OpenClaw 2026.4.2, POST /sessions/:sessionKey/kill did not enforce write scopes in identity-bearing HTTP modes. A caller limited to read-only operator scopes could still terminate a running subagent session.

Impact

A read-scoped caller could perform a write-class control-plane mutation and interrupt delegated work. This was an authorization bug on the HTTP scope boundary, not a shared-secret compatibility exception.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.4.1
Patched versions: >= 2026.4.2
Latest published npm version: 2026.4.1

Fix Commit(s)

54a0878517167c6e49900498cf77420dadb74beb — enforce session-kill HTTP scopes

Release Process Note

The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks @EaEa0001 for reporting.

🎯 Affected products1

npm/openclaw:<= 2026.4.1