Openclaw cli: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers (CVE-2026-53832)

CVE-2026-53832 affects OpenClaw CLI's same-host trusted-proxy deployments. In affected versions (>=2026.1.29 <2026.5.18), a local caller on the same host with access to the proxy-facing Gateway port can forge identity headers that are normally reserved for the trusted proxy. This could lead to the system receiving operator identity associated with these forged headers. The vulnerability is scoped to the named feature and configuration and does not alter the trusted-operator model for authenticated Gateway operators, installed plugins, or intentional local execution surfaces. The first stable patched version is 2026.5.18.

If the affected feature is enabled and reachable, an attacker with local same-host access to the proxy-facing Gateway port could supply forged identity headers, potentially gaining operator identity privileges. The practical impact depends on the operator's configuration and whether lower-trust input can reach the vulnerable path. There is no indication of known exploits in the wild.

A patch is available in OpenClaw CLI version 2026.5.18. Operators should upgrade to this version to remediate the vulnerability. Additionally, bind the trusted-proxy ingress behind the actual proxy and firewall to prevent direct same-host access. Maintain narrow channel and tool allowlists, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.