CVE-2026-53832

Katalog CVE

CVSS 7.1 · High EPSS 0,15%

Kerentanan Authentication Bypass by Spoofing pada openclaw. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity headers to assume operator identity and potentially escalate privileges.

Rincian

Terbit di NVD

12 Juni 2026

Terakhir diubah

23 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-rggc-m335-3wvj mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/openclaw-identity-header-forgery-via-trusted-proxy-configuration advisory pihak ketiga