{"action":"Upgrade openclaw to 2026.3.23 or later.","affected":[{"fixed":"2026.3.23","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-35660"],"ecosystem":"npm","epss":0.00508,"exploited":false,"fixed_versions":["2026.3.23"],"ghsa_id":"GHSA-wq58-2pvg-5h4f","id":"tcs_01M5KGFP563CGQF9VM3DDDA6V2","modified_at":"2026-04-10T17:42:21.130842Z","published_at":"2026-03-26T19:00:45Z","references":["https://osv.dev/vulnerability/GHSA-wq58-2pvg-5h4f","https://github.com/openclaw/openclaw/security/advisories/GHSA-wq58-2pvg-5h4f","https://github.com/openclaw/openclaw/commit/50f6a2f136fed85b58548a38f7a3dbb98d2cd1a0","https://github.com/openclaw/openclaw"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-wq58-2pvg-5h4f","url":"https://osv.dev/vulnerability/GHSA-wq58-2pvg-5h4f"}],"summary":"OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers"}