GHSA-qjpc-qf9m-xwmr: OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
OpenClaw's trusted-proxy Control UI mode improperly accepted client-declared operator scopes on WebSocket connections before these scopes were validated and bound to a server-approved pairing or authorization baseline. This vulnerability affects deployments using the trusted-proxy authentication mode, allowing a restricted or unpaired trusted-proxy client to gain elevated operator.admin authority on a live WebSocket connection. The issue is resolved in OpenClaw version 2026.5.18 and later.
AI Analysis
Technical Summary
In OpenClaw's trusted-proxy Control UI mode, a WebSocket client could declare operator scopes that were accepted prior to server validation and pairing. This flaw allowed an unpaired or restricted trusted-proxy client to obtain cached operator.admin privileges on its active WebSocket connection, enabling admin-level Gateway RPC calls until the connection was closed or revalidated. The vulnerability does not affect shared-secret Control UI sessions. It specifically impacts deployments configured with gateway.auth.mode set to "trusted-proxy". The issue is fixed starting with OpenClaw version 2026.5.18.
Potential Impact
An attacker controlling a trusted-proxy Control UI client with restricted or unpaired status could escalate privileges to operator.admin on an active WebSocket connection. This elevated authority enables execution of admin-gated Gateway RPCs, potentially allowing unauthorized administrative actions until the connection is terminated or revalidated.
Mitigation Recommendations
Upgrade OpenClaw to version 2026.5.18 or later, where this vulnerability is patched. Until the upgrade is applied, restrict trusted-proxy Control UI access to only those users who are authorized for the scopes they request. Additionally, restart the gateway after any changes to trusted-proxy authorization policies to ensure proper enforcement.
GHSA-qjpc-qf9m-xwmr: OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
Description
OpenClaw's trusted-proxy Control UI mode improperly accepted client-declared operator scopes on WebSocket connections before these scopes were validated and bound to a server-approved pairing or authorization baseline. This vulnerability affects deployments using the trusted-proxy authentication mode, allowing a restricted or unpaired trusted-proxy client to gain elevated operator.admin authority on a live WebSocket connection. The issue is resolved in OpenClaw version 2026.5.18 and later.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In OpenClaw's trusted-proxy Control UI mode, a WebSocket client could declare operator scopes that were accepted prior to server validation and pairing. This flaw allowed an unpaired or restricted trusted-proxy client to obtain cached operator.admin privileges on its active WebSocket connection, enabling admin-level Gateway RPC calls until the connection was closed or revalidated. The vulnerability does not affect shared-secret Control UI sessions. It specifically impacts deployments configured with gateway.auth.mode set to "trusted-proxy". The issue is fixed starting with OpenClaw version 2026.5.18.
Potential Impact
An attacker controlling a trusted-proxy Control UI client with restricted or unpaired status could escalate privileges to operator.admin on an active WebSocket connection. This elevated authority enables execution of admin-gated Gateway RPCs, potentially allowing unauthorized administrative actions until the connection is terminated or revalidated.
Mitigation Recommendations
Upgrade OpenClaw to version 2026.5.18 or later, where this vulnerability is patched. Until the upgrade is applied, restrict trusted-proxy Control UI access to only those users who are authorized for the scopes they request. Additionally, restart the gateway after any changes to trusted-proxy authorization policies to ensure proper enforcement.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qjpc-qf9m-xwmr
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a46eccd27e9c7971943efd4
Added to database: 07/02/2026, 22:57:17 UTC
Last enriched: 07/02/2026, 23:20:32 UTC
Last updated: 07/02/2026, 23:20:32 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.