CVE-2026-32302: OpenClaw WebSocket Vulnerability Allows Untrusted Origins to Gain Admin Access
Summary
CVE-2026-32302: OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode. Affects openclaw versions < 2026.3.11. Fixed in 2026.3.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source software package designed to facilitate secure communication between web clients and servers through WebSocket connections. It is commonly used in applications that require real-time data exchange. The package features a trusted-proxy mode that allows for enhanced security by validating requests from known proxies. However, this mode has a vulnerability that can be exploited by untrusted web origins, potentially allowing unauthorized access to sensitive operations.
Vulnerability Detail
The vulnerability arises from the way OpenClaw handles WebSocket connections when operating in trusted-proxy mode. Specifically, it fails to properly validate the origin of browser-originated requests that come with proxy headers. This flaw allows an attacker to exploit a malicious page served from an untrusted origin to establish a WebSocket connection through a trusted reverse proxy. Once connected, the attacker can inherit the proxy-authenticated identity and gain access to privileged operations, such as requesting sensitive configuration data or executing other operator-class methods. The technical oversight lies in the exemption of origin validation for proxy-delivered requests, which creates a critical security gap.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.3.11
This is the first release that contains the fix.
npm install openclaw@2026.3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, it is advised to avoid exposing browser-reachable Gateway WebSocket endpoints in trusted-proxy mode to untrusted origins. Ensure that reverse-proxy and browser reachability is restricted to trusted origins only.
Conclusion
The vulnerability identified as CVE-2026-32302 in OpenClaw poses a significant risk by allowing untrusted web origins to gain authenticated access in trusted-proxy mode. Users are strongly encouraged to upgrade to version 2026.3.11 or later to mitigate this risk. Additionally, implementing the recommended workarounds can help secure applications until an upgrade is possible.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Versions of OpenClaw prior to 2026.3.11 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
If you cannot upgrade immediately, restrict access to WebSocket endpoints to trusted origins only to mitigate the risk.
The main risk is that an attacker can gain unauthorized access to sensitive operations and configurations by exploiting the vulnerability, potentially leading to data exposure or manipulation.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
