{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2026.3.24"}],"component":"openclaw","cve_ids":["CVE-2026-34512"],"ecosystem":"npm","epss":0.00352,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-9p93-7j67-5pc2","id":"tcs_01M5KFGEYPQ9S17Y6JJQ090F8R","modified_at":"2026-07-08T08:12:24.047105Z","published_at":"2026-03-27T22:28:25Z","references":["https://osv.dev/vulnerability/GHSA-9p93-7j67-5pc2","https://github.com/openclaw/openclaw/security/advisories/GHSA-9p93-7j67-5pc2","https://github.com/openclaw/openclaw/commit/02cf12371f9353a16455da01cc02e6c4ecfc4152","https://github.com/openclaw/openclaw"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-9p93-7j67-5pc2","url":"https://osv.dev/vulnerability/GHSA-9p93-7j67-5pc2"},{"source":"nvd","source_id":"CVE-2026-34512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34512"}],"summary":"OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding"}