Openclaw (< 2026.5.18) - CraftedSignal Threat Feed

OpenClaw Vulnerability Allows Local Forged Identity Headers

hello@craftedsignal.io — Fri, 03 Jul 2026 12:17:46 +0000

A significant security vulnerability, tracked as GHSA-rggc-m335-3wvj, has been identified in OpenClaw's trusted-proxy deployments, specifically impacting versions prior to 2026.5.18. This flaw allows a local attacker, operating from the same host where an OpenClaw Gateway instance is running, to forge identity headers. By directly communicating with the proxy-facing Gateway port and presenting these falsified headers, the attacker can effectively bypass the security mechanisms designed for trusted proxies. If the affected feature is active and accessible, this enables the local caller to assume an operator's identity, potentially leading to unauthorized access, configuration changes, or privilege escalation within the OpenClaw environment. This vulnerability is critical for organizations deploying OpenClaw in shared-host or multi-tenant environments where local access by lower-trust processes is possible.

Attack Chain

Initial Access: An attacker gains local access to a system hosting an OpenClaw Gateway instance configured for trusted-proxy deployments. This could be via another compromised application or a low-privilege user account.
Discovery: The attacker probes the local system to identify the specific network port on which the OpenClaw Gateway's proxy-facing service is listening.
Direct Connection: The attacker establishes a direct network connection from their local process to the discovered OpenClaw Gateway port, bypassing the legitimate trusted proxy infrastructure.
Header Forgery: The attacker crafts and sends HTTP requests containing forged identity headers, mimicking those that would normally be generated and supplied by a trusted upstream proxy.
Vulnerable Processing: The affected OpenClaw Gateway instance (versions < 2026.5.18) accepts and processes these forged identity headers from the direct local connection without proper validation.
Identity Assumption: The Gateway attributes the operator identity specified in the forged headers to the local attacker's process.
Privilege Escalation / Unauthorized Actions: The attacker, now operating with the assumed operator identity, performs unauthorized actions such as modifying configurations, accessing sensitive data, or escalating privileges within the OpenClaw system.

Impact

The successful exploitation of this vulnerability can lead to significant security breaches. If an attacker can successfully forge identity headers, they can impersonate an authorized operator within the OpenClaw environment. The practical impact is highly dependent on the privileges associated with the impersonated operator and the specific configurations of the OpenClaw Gateway. This could result in unauthorized configuration changes, data manipulation or exfiltration, or complete administrative control over the OpenClaw instance. Organizations with shared hosting environments or those running multiple applications on the same server as OpenClaw are particularly at risk, as any compromised local process could leverage this flaw.

Recommendation

Patch Immediately: Upgrade all OpenClaw Gateway instances to version 2026.5.18 or newer to remediate the vulnerability described in GHSA-rggc-m335-3wvj.
Network Segmentation: Implement network controls to bind the trusted-proxy ingress behind the actual trusted proxy and firewall direct same-host access to the Gateway port, as mentioned in the GHSA-rggc-m335-3wvj mitigations.
Feature Disablement: Disable the affected trusted-proxy feature if it is not explicitly required for your operational workflow to reduce the attack surface.
Access Control: Ensure that lower-trust applications or users on the same host cannot reach the OpenClaw Gateway's proxy-facing port, following the hardening advice from GHSA-rggc-m335-3wvj.

OpenClaw Scoped Chat Route Inheritance Could Bypass Admin Command Scope Gates

hello@craftedsignal.io — Fri, 03 Jul 2026 12:14:04 +0000

A high-severity vulnerability has been identified in OpenClaw that enables privilege escalation for certain scoped Gateway clients. Specifically, a chat.send request, when delivered through an inherited external route, can be incorrectly evaluated as an external-channel command while retaining the lower Gateway client scopes. This flaw affects OpenClaw deployments where a scoped Gateway caller with operator.write permissions can send commands into sessions utilizing external delivery routes. This bypasses security checks that typically require higher operator.approvals or operator.admin scopes for critical administrative functions. The vulnerability impacts versions prior to 2026.5.18 and allows for unauthorized execution of plugin, config, MCP, allowlist, and ACP mutations.

Attack Chain

An attacker obtains or leverages existing operator.write privileges within a scoped Gateway client in an OpenClaw deployment.
The attacker crafts a malicious chat.send request targeting administrative functions (e.g., plugin, config, MCP, allowlist, or ACP mutations).
The crafted chat.send request is intentionally delivered into a session that possesses an inherited external delivery route.
The OpenClaw system evaluates this specific request path as an external-channel command, despite originating from a scoped Gateway client.
During this evaluation, the request erroneously retains the lower operator.write client scopes, rather than requiring the higher operator.approvals or operator.admin scopes mandated for the targeted administrative commands.
The administrative command is executed with insufficient privileges, bypassing the intended security scope gates and achieving privilege escalation within the OpenClaw environment.

Impact

The successful exploitation of this vulnerability allows an attacker with only operator.write permissions to execute commands that should explicitly require higher operator.approvals or operator.admin scopes. This includes critical administrative commands related to plugin management, configuration changes, Message Control Protocol (MCP) modifications, allowlist adjustments, and Access Control Policy (ACP) mutations. Such unauthorized execution can lead to severe system compromise, data manipulation, unauthorized access, and potentially full control over the OpenClaw instance, undermining the integrity and security posture of the platform.

Recommendation

Upgrade all OpenClaw instances to version openclaw@2026.5.18 or later immediately to patch the vulnerability.
Review and restrict operator.write token grants: Avoid granting operator.write tokens to clients that can deliver commands into sessions with external routes unless those clients are explicitly trusted with admin-like command effects.

OpenClaw Trusted-proxy Control UI Privilege Escalation (GHSA-qjpc-qf9m-xwmr)

hello@craftedsignal.io — Fri, 03 Jul 2026 12:03:27 +0000

A significant vulnerability has been identified in OpenClaw's trusted-proxy Control UI, designated GHSA-qjpc-qf9m-xwmr. This flaw permits an attacker to bypass authorization mechanisms by declaring elevated operator scopes via a WebSocket connection, even if their device identity is unpaired or restricted. Specifically, the system accepts these client-declared scopes before validating them against a server-approved pairing or trusted-proxy authorization baseline. This can lead to a temporary privilege escalation, granting operator.admin authority which allows the execution of administrative Gateway RPCs. The issue affects OpenClaw deployments configured with gateway.auth.mode: "trusted-proxy" and impacts versions prior to 2026.5.18. Defenders must prioritize upgrading to the patched version to prevent unauthorized access and potential system compromise.

Attack Chain

An attacker gains or establishes a connection to a trusted-proxy Control UI client with either an unpaired device identity or a restricted trusted-proxy user account.
The attacker opens a WebSocket connection to the OpenClaw gateway using this client.
During the WebSocket handshake or early communication, the attacker's client declares elevated operator scopes, such as operator.admin, for its session.
The OpenClaw gateway, due to the vulnerability, accepts these client-declared scopes without immediately verifying them against the pre-established trusted-proxy authorization policy or a server-approved pairing.
The attacker temporarily obtains cached operator.admin authority on their live WebSocket connection, despite their actual authorization level.
Using this elevated authority, the attacker executes admin-gated Gateway RPCs, potentially performing unauthorized administrative actions.
The administrative authority persists until the WebSocket connection is closed or the gateway performs a revalidation of the client's scopes.

Impact

This vulnerability can lead to unauthorized administrative control over the OpenClaw gateway. An attacker exploiting this flaw could execute any operator.admin-gated RPCs, potentially leading to configuration changes, data manipulation, or denial of service within the affected system. While the authority is temporary (lasting until the connection closes or revalidates), it provides a window for attackers to cause significant damage. The vulnerability specifically targets deployments utilizing gateway.auth.mode: "trusted-proxy", making environments relying on this mode susceptible to privilege escalation.

Recommendation

Upgrade all OpenClaw installations to version openclaw@2026.5.18 or later to patch the vulnerability as stated in the source.
Before upgrading, restrict trusted-proxy Control UI access to only those users who are genuinely authorized for the scopes they are permitted to request.
Restart the OpenClaw gateway after implementing any changes to the trusted-proxy authorization policy to ensure the new policies are active.