Executive brief
OpenClaw is an AI automation platform that uses WebSocket connections to handle operator commands through a reverse proxy. When deployed behind a trusted proxy with origin checks enabled, the WebSocket handshake logic incorrectly exempted proxy-delivered requests from browser origin validation. An attacker could craft a malicious webpage that tricks a victim's browser into connecting through the proxy and obtain operator.admin privileges to read or modify system configuration.
Technical details
The vulnerability is a cross-site WebSocket hijacking (CSWSH) issue caused by improper origin validation (CWE-346). In trusted-proxy mode, the WebSocket handshake treated any request with both an Origin header and proxy headers as exempt from origin checks. This allowed browser-originated connections from untrusted origins to bypass the controlUi.allowedOrigins restriction entirely and establish authenticated operator sessions by inheriting the proxy-injected identity. An attacker can cause a victim to load a malicious page that initiates a WebSocket connection to the Gateway endpoint; if the victim's browser can reach the trusted proxy, the connection succeeds and gains operator.admin scope, enabling config.get calls and potentially other privileged operations. The fix, shipped in openclaw@2026.3.11, enforces browser origin validation for all browser-originated WebSocket connections regardless of proxy header presence (commit ebed3bbd).
Affected products
- OpenClaw openclaw < 2026.3.11
Timeline
- 2026-03-12: disclosed: GHSA-5wcw-8jjv-m286 published
- 2026-03-12: patched: Fixed in openclaw@2026.3.11 via commit ebed3bbd