Search: CVE-2026-53832

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.5.18 have a vulnerability where same-host trusted-proxy deployments could accept locally forged identity headers. This allows a local caller on the same host who can access the proxy-facing Gateway port to supply identity headers normally reserved for the trusted proxy. The vulnerability affects operator identity handling when the feature is enabled and reachable. A patch is available in version 2026.5.18. Mitigations include restricting access to the trusted-proxy ingress behind a proxy and firewall, narrowing allowlists, avoiding sharing Gateways between untrusted users, and disabling the feature if not needed.