Uninstalling openclaw, Security audit shows critical
I ran "openclaw uninstall", but I still get report in "openclaw status".
I received critical warnings when running "openclaw security audit". here are the details:
OpenClaw security audit
Summary: 2 critical · 1 warn · 1 info
Run deeper: openclaw security audit --deep
CRITICAL
gateway.loopback_no_auth Gateway auth missing on loopback
gateway.bind is loopback but no gateway auth secret is configured. If the Control UI is exposed through a reverse proxy, unauthenticated access is possible.
Fix: Set gateway.auth (token recommended) or keep the Control UI local-only.
browser.control_no_auth Browser control has no auth
Browser control HTTP routes are enabled but no gateway.auth token/password is configured. Any local process (or SSRF to loopback) can call browser control endpoints.
Fix: Set gateway.auth.token (recommended) or gateway.auth.password so browser control HTTP routes require authentication. Restarting the gateway will auto-generate gateway.auth.token when browser control is enabled.
WARN
gateway.trusted_proxies_missing Reverse proxy headers are not trusted
gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.
Fix: Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.
INFO
summary.attack_surface Attack surface summary
groups: open=0, allowlist=0
tools.elevated: enabled
hooks.webhooks: disabled
hooks.internal: disabled
browser control: enabled
trust model: personal assistant (one trusted operator boundary), not hostile multi-tenant on one shared gateway
I received critical warnings when running "openclaw security audit". here are the details:
OpenClaw security audit
Summary: 2 critical · 1 warn · 1 info
Run deeper: openclaw security audit --deep
CRITICAL
gateway.loopback_no_auth Gateway auth missing on loopback
gateway.bind is loopback but no gateway auth secret is configured. If the Control UI is exposed through a reverse proxy, unauthenticated access is possible.
Fix: Set gateway.auth (token recommended) or keep the Control UI local-only.
browser.control_no_auth Browser control has no auth
Browser control HTTP routes are enabled but no gateway.auth token/password is configured. Any local process (or SSRF to loopback) can call browser control endpoints.
Fix: Set gateway.auth.token (recommended) or gateway.auth.password so browser control HTTP routes require authentication. Restarting the gateway will auto-generate gateway.auth.token when browser control is enabled.
WARN
gateway.trusted_proxies_missing Reverse proxy headers are not trusted
gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.
Fix: Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.
INFO
summary.attack_surface Attack surface summary
groups: open=0, allowlist=0
tools.elevated: enabled
hooks.webhooks: disabled
hooks.internal: disabled
browser control: enabled
trust model: personal assistant (one trusted operator boundary), not hostile multi-tenant on one shared gateway
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
134,426Members
Resources
Similar Threads
Was this page helpful?
