Threats tagged 'ghsa-mhr7-2xmv-4c4q'

OpenClaw versions prior to 2026.3.31 have a vulnerability where HTTP operator endpoints lack browser-origin validation in trusted-proxy mode. This creates a Cross-Site Request Forgery (CSRF) risk when identity-bearing trusted-proxy browser deployments are used. The issue is not critical because it depends on specific deployment models rather than the shared-secret HTTP operator model. The vulnerability is fixed in version 2026.3.31.