Authentication Bypass by Spoofing in OpenClaw - #VU125189
Published: April 8, 2026
Vulnerability identifier: #VU125189
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-290
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and rate limiting.
The vulnerability exists due to authentication bypass by spoofing in client origin resolution for canvas auth and auth-rate-limit paths when processing forwarding headers with trusted proxies configured. A remote attacker can send spoofed forwarding headers with loopback hops to bypass authentication and rate limiting.
Exploitation requires gateway.trustedProxies to be configured.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.3.22