CVE-2026-32302

Published: Mar 13, 2026Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

OpenClaw is a personal AI assistant. Prior to 2026.3.11, browser-originated WebSocket connections could bypass origin validation when gateway.auth.mode was set to trusted-proxy and the request arrived with proxy headers. A page served from an untrusted origin could connect through a trusted reverse proxy, inherit proxy-authenticated identity, and establish a privileged operator session. This vulnerability is fixed in 2026.3.11.

Affected (1)

Products: Openclaw: Openclaw

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openclaw Openclaw	Before 2026.3.11

Related CWEs

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (3)

https://github.com/openclaw/openclaw/commit/ebed3bbde1a72a1aaa9b87b63b91e7c04a50036b

Source: security-advisories@github.com

Patch

https://github.com/openclaw/openclaw/releases/tag/v2026.3.11

Source: security-advisories@github.com

PatchProduct

https://github.com/openclaw/openclaw/security/advisories/GHSA-5wcw-8jjv-m286

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.