GHSA-844j-xrrq-wgh4

Suggest an improvement
Source
https://github.com/advisories/GHSA-844j-xrrq-wgh4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-844j-xrrq-wgh4/GHSA-844j-xrrq-wgh4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-844j-xrrq-wgh4
Aliases
  • CVE-2026-35656
Downstream
Published
2026-03-26T21:42:30Z
Modified
2026-04-10T20:03:58.089712Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw: Forwarding header spoofing bypasses gateway.trustedProxies origin detection
Details

Summary

When gateway.trustedProxies was configured, spoofed loopback hops in forwarding headers could be accepted as the client origin and weaken downstream auth and rate-limit decisions.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: < 2026.3.22
  • Fixed: >= 2026.3.22
  • Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
  • Latest published npm version checked: 2026.3.23-2

Fix Commit(s)

  • fc2d29ea926f47c428c556e92ec981441228d2a4

Release Status

The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.

Code-Level Confirmation

  • src/gateway/net.ts now ignores loopback forwarded hops before trusted-proxy client resolution.
  • That shipped origin fix is the one consumed by canvas auth and gateway auth-rate-limit paths that rely on resolved client identity.

OpenClaw thanks @lintsinghua for reporting.

Database specific 
{
    "cwe_ids": [
        "CWE-290"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T21:42:30Z",
    "nvd_published_at": "2026-04-10T17:17:06Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.3.22

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-844j-xrrq-wgh4/GHSA-844j-xrrq-wgh4.json"