Openclaw cli: OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection (CVE-2026-35656)

When the gateway.trustedProxies setting is configured in openclaw CLI versions before 2026.3.22, an attacker can spoof loopback hops in forwarding headers. These spoofed headers may be accepted as the client origin, potentially bypassing security controls such as authentication and rate-limiting that depend on the resolved client identity. The vulnerability was addressed by ignoring loopback forwarded hops before trusted-proxy client resolution in the source code (src/gateway/net.ts). The fix was introduced in version 2026.3.22 and remains in subsequent releases.

The vulnerability allows an attacker to spoof the client origin by injecting loopback hops in forwarding headers, which can weaken authentication and rate-limiting mechanisms downstream. This may lead to unauthorized access or abuse of service due to incorrect client identity resolution. The CVSS v3.1 score is 6.5 (medium severity), reflecting a network attack vector with low complexity and no user interaction required, impacting confidentiality and integrity but not availability.

A patch is available and should be applied by upgrading to openclaw CLI version 2026.3.22 or later. The fix ignores loopback forwarded hops before trusted-proxy client resolution, preventing spoofing of the client origin. Users should verify they are running a fixed version to ensure protection against this vulnerability.