PT-2026-26422 · Openclaw · Openclaw

Teipete · Publicado 2026-03-02 · Atualizado 2026-04-09 · CVE-2026-32041

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1

Description OpenClaw does not correctly manage authentication bootstrap errors during startup, which can allow browser-control routes to remain accessible without authentication. Local processes or loopback-reachable Server-Side Request Forgery (SSRF) paths can exploit this to access browser-control routes, including actions capable of evaluating code, without valid credentials. The software attempted to automatically bootstrap authentication when browser control started without explicit credentials. If this bootstrap process failed, startup continued, exposing browser-control routes without authentication.

Recommendations Update to version 2026.3.1 or later.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-32041

GHSA-VPJ2-69HF-RPPW

Produtos afetados

Openclaw

Referências · 8

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vpj2-69hf-rppw · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034891576166486407 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-unauthenticated-browser-control-access-via-failed-auth-bootstrap · Nota
• https://twitter.com/pulsepatchio/status/2038634461131411872 · Publicação no Twitter
• https://twitter.com/dailycve/status/2042312495654727972 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32041 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vpj2-69hf-rppw · Aviso do Fabricante