PT-2026-25083 · Git+2 · Openclaw

Yianworks · Published 2026-03-12 · Updated 2026-03-18 · CVE-2026-32302

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description OpenClaw is a personal AI assistant. Browser-originated WebSocket connections could bypass origin validation when gateway.auth.mode was set to trusted-proxy and the request arrived with proxy headers. This allowed a page served from an untrusted origin to connect through a trusted reverse proxy, inherit proxy-authenticated identity, and establish a privileged operator session. An attacker could request operator.admin access and call config.get, potentially exposing sensitive configuration. The issue affects deployments that expose the Gateway behind a trusted reverse proxy and rely on browser origin checks. The WebSocket handshake logic treated proxy-delivered requests as exempt from the generic browser origin check when an Origin header was present alongside proxy headers.

Recommendations Upgrade to version 2026.3.11 or later. If you cannot upgrade immediately, avoid exposing browser-reachable Gateway WebSocket endpoints in trusted-proxy mode to untrusted origins, and ensure reverse-proxy/browser reachability is restricted to trusted origins only.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-32302

GHSA-5WCW-8JJV-M286

Affected Products

Openclaw

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32302.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5wcw-8jjv-m286 · Vendor Advisory
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.11 · Patch
• https://github.com/openclaw/openclaw/commit/ebed3bbde1a72a1aaa9b87b63b91e7c04a50036b · Patch
• https://osv.dev/vulnerability/CVE-2026-32302 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5wcw-8jjv-m286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32302 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/rwsanders/status/2034301118663241840 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034045456850771999 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rsmg3s/resumen_diario_de_vulnerabilidades_13032026 · Reddit Post
• https://twitter.com/TheHackerWire/status/2032577550569070832 · Twitter Post
• https://twitter.com/CVEnew/status/2032230645976477699 · Twitter Post
• https://t.me/CVEtracker/47300 · Telegram Post