The vulnerability lies in OpenClaw’s handling of proxied remote requests. When allowRemoteViewer is disabled, the software mistakenly treats these requests as loopback traffic, effectively bypassing the access controls implemented in the diffs viewer. This is a CWE-807 vulnerability, involving cross‑reference validation failure. Attackers can exploit this misclassification to read or manipulate diffs that they are not authorized to see, compromising the confidentiality and integrity of repository data.

OpenClaw software versions prior to 2026.3.31. The vulnerability affects installations that run on a Node.js environment as indicated by the linked CPE entry.

The vulnerability scores a CVSS of 6.3, indicating moderate severity. No EPSS score is available, so the exploitation likelihood is uncertain. It is not listed in CISA’s KEV catalog, suggesting limited or no known exploitation. The attack requires the attacker to send a proxied request that the system incorrectly classifies as local loopback traffic, so some network access or proxy influence is necessary.