Executive brief
OpenClaw is an AI automation platform used to execute tasks and manage deployments across systems. In affected versions, a local attacker with access to the Gateway service port can forge identity headers to impersonate operators, potentially gaining their elevated privileges. This impacts organizations running OpenClaw with the trusted-proxy feature enabled on the same host where untrusted code or users can reach the Gateway port.
Technical details
The vulnerability is an authentication bypass via spoofing (CWE-290, CWE-287, CWE-284) in OpenClaw's identity header validation mechanism. The vulnerable component is the trusted-proxy feature in the Gateway, which does not properly validate or restrict identity headers supplied by local same-host callers. The attack vector is local network access to the proxy-facing Gateway port; no authentication is required, but the attacker must be able to reach that port from the same host. An attacker can supply forged identity headers normally reserved for trusted proxies to assume the identity of an operator and potentially execute privileged operations. The vulnerability is fixed in version 2026.5.18 and later. Mitigations include binding trusted-proxy ingress behind an actual proxy and firewall, and disabling the feature when not needed.
Affected products
- OpenClaw OpenClaw < 2026.5.18
Timeline
- 2026-05-28: disclosed: Advisory GHSA-rggc-m335-3wvj published
- 2026-05-18: patched: Version 2026.5.18 released with fix