CVE-2026-41403: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41403 is an access control bypass vulnerability in OpenClaw (npm package) affecting all versions up to and including 2026.3.28. The flaw causes the diffs viewer component to misclassify proxied remote requests as local loopback connections when the allowRemoteViewer setting is disabled, allowing unauthorized remote access to diff artifacts. The vulnerability was reported by researcher smaeljaish771, sponsored by KeenSecurityLab, and disclosed via a GitHub Security Advisory on March 31, 2026, with a patch released in version 2026.3.31. It carries a CVSS v3.1 base score of 4.0 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision). The vulnerable resolveViewerAccess function in extensions/diffs/src/http.ts determined whether a request was local by checking only the raw socket remote address and the presence of proxy-forwarding headers, without accounting for trusted proxy configurations. An attacker could send a proxied HTTP request with appropriate forwarding headers (e.g., X-Forwarded-For) from a remote origin; the function would detect proxy hints and fall back to logic that could incorrectly classify the connection as loopback, bypassing the allowRemoteViewer: false restriction. The fix introduced proper integration with the gateway's trustedProxies and allowRealIpFallback configuration, and updated resolveViewerAccess to use resolveRequestClientIp from the plugin SDK, ensuring proxy-forwarded requests are never treated as local unless the originating IP is genuinely a loopback address (GitHub Commit, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to access the diffs viewer functionality that is intended to be restricted to local/loopback connections only. The impact is limited to low-level confidentiality exposure — specifically, unauthorized read access to diff artifacts — with no impact on integrity or availability. Lateral movement potential is minimal given the narrow scope of the exposed functionality (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.042% (0.000420), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to send proxied HTTP requests to the target OpenClaw instance, which adds a prerequisite attack condition (Feedly, GitHub Advisory).

1. Reconnaissance: Identify OpenClaw instances running versions <=2026.3.28 (npm) that have allowRemoteViewer set to false and are accessible via a proxy or load balancer.
2. Craft proxied request: Send an HTTP GET request to the diffs viewer endpoint (e.g., /diffs/<artifact-id>/viewer) with proxy-forwarding headers such as X-Forwarded-For: 127.0.0.1 or X-Real-IP: 127.0.0.1 to simulate a loopback origin.
3. Trigger misclassification: The vulnerable resolveViewerAccess function detects the proxy-forwarding headers and, due to the flawed logic, may classify the request as originating from a local loopback address, bypassing the allowRemoteViewer: false restriction.
4. Access restricted diff artifacts: The server responds with the diff viewer content (HTTP 200) instead of the expected 404, granting unauthorized read access to diff artifacts (GitHub Commit, GitHub Advisory).

• Network: Unexpected HTTP GET requests to diffs viewer paths (e.g., /diffs/*/viewer) from non-loopback IP addresses returning HTTP 200 responses when allowRemoteViewer is disabled; requests containing X-Forwarded-For or X-Real-IP headers with loopback addresses (e.g., 127.0.0.1, ::1) originating from external IPs.
• Logs: Access log entries showing successful (200) responses to diffs viewer endpoints from remote IP addresses; repeated access to diff artifact paths from IPs not in the configured trusted proxy list.

Upgrade OpenClaw (npm) to version 2026.3.31 or later, which contains the fix commit 30a1690 that hardens viewer proxy access by properly integrating gateway trusted proxy configuration. As a temporary workaround, ensure that the OpenClaw instance is not directly reachable via untrusted proxies, or restrict network-level access to the diffs viewer endpoint. Additionally, review and explicitly configure gateway.trustedProxies in the OpenClaw configuration to limit which proxy IPs are trusted for client IP resolution (GitHub Advisory, GitHub Commit).