Home

Description

OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly identified as local loopback traffic, circumventing intended remote viewer restrictions.

PUBLISHED Reserved 2026-04-20 | Published 2026-04-28 | Updated 2026-04-28 | Assigner VulnCheck




MEDIUM: 6.3CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

LOW: 2.9CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-807 Reliance on Untrusted Inputs in a Security Decision

Product status

Default status
unaffected

Any version before 2026.3.31
affected

2026.3.31 (semver)
unaffected

Credits

smaeljaish771 reporter

KeenSecurityLab finder

References

github.com/...enclaw/security/advisories/GHSA-3xv9-89fm-7h4r (GitHub Security Advisory (GHSA-3xv9-89fm-7h4r)) vendor-advisory

github.com/...ommit/30a1690323088fd291abd11643a264a6828a002c (Patch Commit) patch

www.vulncheck.com/...roxied-remote-request-misclassification (VulnCheck Advisory: OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification) third-party-advisory

cve.org (CVE-2026-41403)

nvd.nist.gov (CVE-2026-41403)

Download JSON