EUVD-2026-25331
GHSA-2xp4-qhr4-xqm2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required trusted-proxy deployment mode; UI:R for mandatory victim browser interaction; no confidentiality or availability impact per CVSS 4.0 VC:N/VA:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.31.
DescriptionCVE.org
OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a browser in trusted-proxy deployments to perform unauthorized actions on HTTP operator endpoints.
AnalysisAI
Cross-site request forgery in OpenClaw's HTTP operator endpoints affects deployments running in trusted-proxy mode, allowing unauthenticated remote attackers to perform unauthorized actions by tricking an authenticated browser user into triggering a forged request. Affected versions are all OpenClaw npm releases up to and including 2026.3.28; the vulnerability is fully patched in 2026.3.31 released 2026-03-31. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS sits at 0.01% (3rd percentile), consistent with SSVC exploitation status of 'none' - real-world risk is low and narrowly scoped to identity-bearing trusted-proxy browser deployments.
Technical ContextAI
OpenClaw (npm package; CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) is an AI gateway that supports a trusted-proxy authentication mode where the gateway trusts identity headers (e.g., X-Forwarded-User) forwarded by an upstream proxy. In this mode, the gateway's HTTP operator endpoints previously lacked validation of the browser Origin header, the root cause classified as CWE-352 (Cross-Site Request Forgery). The patch (commit 6b3f99a) introduces a checkBrowserOrigin function in src/gateway/origin-check.js and wires it into src/gateway/auth.ts via a new authorizeTrustedProxyBrowserOrigin step that rejects requests carrying a mismatched or disallowed Origin header while intentionally permitting origin-less requests from headless proxy clients to continue working. The CVSS 4.0 vector AT:P (Attack Requirements: Present) formally encodes the trusted-proxy deployment prerequisite.
RemediationAI
Upgrade the openclaw npm package to version 2026.3.31 or later, which contains the fix introduced in commit 6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d. The vendor advisory is at https://github.com/openclaw/openclaw/security/advisories/GHSA-mhr7-2xmv-4c4q. If an immediate upgrade is not possible, the most effective compensating control is to disable trusted-proxy mode entirely and switch to the shared-secret HTTP operator authentication model, eliminating the vulnerable code path with no loss of core functionality. Alternatively, place HTTP operator endpoints behind a network-layer control (firewall rule or reverse-proxy ACL) that restricts access to internal, non-browser clients only, preventing cross-origin browser requests from reaching the endpoint; note this approach requires careful validation to avoid misconfiguration. Adding a CSRF token or enforcing SameSite=Strict cookies at the reverse-proxy layer are additional mitigations but are less reliable than upgrading.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today