https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 14:06:00 +0000 https://db.gcve.eu/vuln/cve-2026-53832 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity headers to assume operator identity and potentially escalate privileges.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity headers to assume operator identity and potentially escalate privileges.</p> https://db.gcve.eu/vuln/cve-2026-53832 https://db.gcve.eu/vuln/ghsa-rggc-m335-3wvj <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>Same-host trusted-proxy deployments could accept local forged identity headers. In affected versions, a local same-host caller that can reach the proxy-facing Gateway port could supply identity headers normally reserved for the trusted proxy.</p> <p>This advisory is scoped to the named feature and configuration. It does not change OpenClaw&#39;s trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.</p> <p>### Impact</p> <p>When the affected feature is enabled and reachable, this could receive operator identity associated with the forged headers. Practical impact depends on the operator&#39;s configuration and whether lower-trust input can reach that path.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>bind trusted-proxy ingress behind the actual proxy and firewall direct same-host access. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary</p> <p>Same-host trusted-proxy deployments could accept local forged identity headers. In affected versions, a local same-host caller that can reach the proxy-facing Gateway port could supply identity headers normally reserved for the trusted proxy.</p> <p>This advisory is scoped to the named feature and configuration. It does not change OpenClaw&#39;s trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.</p> <p>### Impact</p> <p>When the affected feature is enabled and reachable, this could receive operator identity associated with the forged headers. Practical impact depends on the operator&#39;s configuration and whether lower-trust input can reach that path.</p> <p>### Patched Versions</p> <p>The first stable patched version is `2026.5.18`.</p> <p>### Mitigations</p> <p>bind trusted-proxy ingress behind the actual proxy and firewall direct same-host access. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.</p> https://db.gcve.eu/vuln/ghsa-rggc-m335-3wvj