PT-2026-34778 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-04-03 · Updated 2026-04-25 · CVE-2026-41347

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description When operating in trusted-proxy mode, the software lacks browser-origin validation in HTTP operator endpoints. This allows cross-site request forgery (CSRF) attacks, where attackers send malicious requests from a browser in trusted-proxy deployments to perform unauthorized actions on HTTP operator endpoints.

Recommendations Update to version 2026.3.31.

Fix

CSRF

Origin Validation Error

Weakness Enumeration

CWE-352

CWE-346

Related Identifiers

CVE-2026-41347

GHSA-2XP4-QHR4-XQM2

GHSA-MHR7-2XMV-4C4Q

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-mhr7-2xmv-4c4q · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d · Patch
• https://osv.dev/vulnerability/GHSA-mhr7-2xmv-4c4q · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2xp4-qhr4-xqm2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41347 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://twitter.com/CVEnew/status/2048168361725743136 · Twitter Post
• https://vulncheck.com/advisories/openclaw-cross-site-request-forgery-via-missing-browser-origin-validation-in-http-operator-endpoints · Note