OpenClaw versions prior to 2026.3.22 contain an authentication bypass vulnerability in the processing of the X‑Forwarded‑For header when the trustedProxies setting is enabled. An attacker can forge loopback addresses in this header to impersonate a local client. Through this flaw, the application’s canvas authentication and rate‑limiting controls can be circumvented, allowing the attacker to gain unauthorized access to protected resources or exhaust service limits. The weakness is categorized as CWE‑290, Broken Authentication.

Any installation of OpenClaw (OpenClaw:OpenClaw) running a version earlier than 2026.3.22 is affected. These deployments typically run on a Node.js runtime as indicated by the supplied CPE.

The CVSS score of 6.3 indicates a medium severity impact. No EPSS data is available, but the lack of listing in CISA’s KEV catalog suggests no publicly known exploit yet. Exploitation requires the ability to send HTTP requests with a crafted X‑Forwarded‑For header, which is generally possible from any remote host. Once the header is accepted, the attacker can bypass authentication and rate limits, potentially enabling further compromise of the system.