OpenClaw CSRF Vulnerability: High-Severity Risk in Trusted-Proxy Deployments

The National Vulnerability Database has disclosed CVE-2026-41347, a high-severity (CVSS 7.1) Cross-Site Request Forgery (CSRF) vulnerability affecting OpenClaw before version 2026.3.31. This flaw stems from a lack of browser-origin validation in the HTTP operator endpoints when OpenClaw is configured in trusted-proxy mode.

Attackers can exploit this by crafting malicious requests from a browser, enabling unauthorized actions on HTTP operator endpoints within trusted-proxy deployments. The critical aspect here is the trusted-proxy configuration, which often implies a more permissive network posture, making the lack of origin validation particularly dangerous.

For defenders, this means any OpenClaw instance running in a trusted-proxy setup is a prime target. The attacker’s calculus is straightforward: leverage a common web vulnerability (CWE-352) against a potentially high-privilege endpoint, bypassing typical network controls that might otherwise block direct access. Patching is non-negotiable, and CISO’s need to ensure their security architecture accounts for proper origin validation even behind trusted proxies.