GHSA-xh9j-mpc9-2m9p: Duplicate Advisory: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions
(updated )
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vvgp-4c28-m3jm. This link is maintained to preserve external references.
Original Description
OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.
References
- github.com/advisories/GHSA-xh9j-mpc9-2m9p
- github.com/openclaw/openclaw/commit/ec45c317f5d0631a3d333b236da58c4749ede2a3
- github.com/openclaw/openclaw/security/advisories/GHSA-vvgp-4c28-m3jm
- nvd.nist.gov/vuln/detail/CVE-2026-32057
- www.vulncheck.com/advisories/openclaw-authentication-bypass-via-control-ui-client-id-parameter
Code Behaviors & Features
Detect and mitigate GHSA-xh9j-mpc9-2m9p with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →