Executive brief
OpenClaw is a platform that processes and displays code diffs across systems. When the remote viewer feature is disabled for security, the application incorrectly classified requests coming through a proxy server as if they originated from the local machine, potentially allowing unauthorized access to diff viewing functionality that should have been restricted. This misconfiguration could enable attackers to bypass intended access controls on sensitive code comparisons.
Technical details
The vulnerability is an access control bypass (CWE-348, CWE-807) in OpenClaw's diffs viewer proxy handling. When the `allowRemoteViewer` setting is disabled to restrict diff access to local users only, the application fails to properly distinguish between genuinely local requests and proxied remote requests that appear to originate from the loopback address. Attackers with network access to the application through a reverse proxy can craft requests that bypass this check. The fix, committed in March 2026, hardens the proxy access logic by introducing explicit `trustedProxies` and `allowRealIpFallback` configuration options and properly resolving the actual client IP using the `resolveRequestClientIp` function exported from the webhook-ingress plugin SDK.
Affected products
- openclaw openclaw <=2026.3.28
Timeline
- 2026-03-31: disclosed
- 2026-03-30: patched: Fix committed; released in v2026.3.31
- 2026-04-03: advisory
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4r
- https://github.com/openclaw/openclaw/commit/30a1690323088fd291abd11643a264a6828a002c
- https://github.com/openclaw/openclaw
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.31
- https://www.vulncheck.com/advisories/openclaw-access-control-bypass-via-proxied-remote-request-misclassification