OpenClaw versions before 2026.2.21 incorrectly parse the left‑most value of the X‑Forwarded‑For header when requests come from configured trusted proxies. This allows an attacker to inject an arbitrary IP address, effectively spoofing the client’s IP. The spoofed IP can be used to bypass IP‑based access controls, evade authentication rate limiting, and potentially gain unauthorized access to restricted resources. The vulnerability is classified under CWE‑345: Incorrect Validation of IP Address.

The affected product is OpenClaw, version 2026.2.21 and earlier. No other product versions are explicitly listed as vulnerable. The CNAs data indicates that all releases prior to 2026.2.21 are impacted.

The CVSS score for this vulnerability is 6.3, indicating moderate severity. EPSS information is not available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw over the network by sending HTTP requests with a crafted X‑Forwarded‑For header from an IP that the application trusts. Once the header is parsed, the spoofed address replaces the true client IP in the application's logic, allowing the attacker to subvert authentication checks and other IP‑aware controls.