GHSA-mhr7-2xmv-4c4q: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode

April 3, 2026

HTTP operator endpoints lack browser-origin validation in trusted-proxy mode

References

github.com/advisories/GHSA-mhr7-2xmv-4c4q
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/6b3f99a11f4d070fa5ed2533abbb3d7329ea4f0d
github.com/openclaw/openclaw/releases/tag/v2026.3.31
github.com/openclaw/openclaw/security/advisories/GHSA-mhr7-2xmv-4c4q

Code Behaviors & Features

Detect and mitigate GHSA-mhr7-2xmv-4c4q with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →