Openclaw cli: OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent` (CVE-2026-32919)

In openclaw-cli versions <= 2026.3.10, a gateway caller granted operator.write but not operator.admin could issue agent requests containing /new or /reset commands that reach the same session reset logic intended only for admin users. This happens because scope checks were only applied at the outer RPC method level, while the agent slash-command path reused admin-only session reset logic internally. The fix in version 2026.3.11 separates the reset logic into a shared service and restricts sessions.reset to admin-only callers, preventing write-scoped users from resetting sessions.

Users with operator.write permissions but without operator.admin can reset targeted conversation state, violating the intended permission boundaries. This could disrupt conversation continuity or availability by allowing unauthorized session resets. There is no confidentiality impact, but integrity and availability are affected.

Upgrade openclaw-cli to version 2026.3.11 or later, where the vulnerability is fixed. The fix ensures that /new and /reset agent commands no longer route through the admin-only sessions.reset entry point. No other workarounds are documented.