Description
OpenClaw before 2026.3.31 lacks browser-origin validation in HTTP operator endpoints when operating in trusted-proxy mode, allowing cross-site request forgery attacks. Attackers can exploit this by sending malicious requests from a browser in trusted-proxy deployments to perform unauthorized actions on HTTP operator endpoints.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OpenClaw OpenClaw
Default version status: unaffected
0 to < 2026.3.31affected2026.3.31unaffected
pkg:npm/openclawReferences
- https://github.com/openclaw/openclaw/security/advisories/GHSA-mhr7-2xmv-4c4q ↗
- https://github.com/openclaw/openclaw/commit/6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d ↗
- https://www.vulncheck.com/advisories/openclaw-cross-site-request-forgery-via-missing-browser-origin-validation-in-http-operator-endpoints ↗