A cross-site request forgery vulnerability in OpenClaw allows unauthenticated attackers to perform unauthorized actions on HTTP operator endpoints within trusted-proxy deployments.

The application fails to validate the browser origin for HTTP operator endpoints when operating in trusted-proxy mode. This allows an unauthenticated attacker to trick a user into executing unintended actions by forcing their browser to send malicious requests to the vulnerable endpoints.

Successful exploitation allows an attacker to perform unauthorized state-changing operations on behalf of an authenticated user. This could lead to unauthorized administrative actions, configuration changes, or the manipulation of sensitive data, resulting in potential service disruption or loss of control over the affected infrastructure. Given the CVSS score of 7.1, this represents a significant security risk that necessitates prompt attention to protect the integrity of the application environment.

Immediate Action: Update the OpenClaw package to version 2026.3.31 or later to implement proper origin validation.

Proactive Monitoring: Review web server access logs for suspicious cross-origin request patterns or requests targeting sensitive operator endpoints that originate from unexpected referrers.

Compensating Controls: Deploy a Web Application Firewall (WAF) to enforce strict origin header checks and validate request authenticity for all traffic hitting the HTTP operator endpoints.

Public Exploit Available: No (exploit_available: false)

The vulnerability presents a credible risk for organizations utilizing trusted-proxy configurations, as it allows for unauthorized manipulation of the application state. Security teams should prioritize updating the OpenClaw software to version 2026.3.31 to ensure that origin validation is correctly enforced. Immediate patching is the most effective way to eliminate this risk and prevent potential exploitation of the HTTP operator endpoints.