PT-2026-26415 · Openclaw · Openclaw

Vasco · Published 2026-03-03 · Updated 2026-04-23 · CVE-2026-32034

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.21

Description OpenClaw versions before 2026.2.21 have an authentication bypass issue in the Control UI. This occurs when allowInsecureAuth is enabled and the gateway is exposed over plaintext HTTP, allowing attackers to bypass device identity and pairing verification. An attacker with compromised credentials can gain high-privilege access to the Control UI by exploiting the lack of secure authentication enforcement over unencrypted HTTP connections. The issue requires an insecure deployment choice and credential exposure. The fix was implemented in commit 40a292619e1f2be3a3b1db663d7494c9c2dc0abf. The vulnerable configuration parameter is gateway.controlUi.allowInsecureAuth.

Recommendations Update to version 2026.2.21 or later.

Fix

Cleartext Transmission of Sensitive Information

Improper Authorization

OS Command Injection

Weakness Enumeration

CWE-319

CWE-285

CWE-78

Related Identifiers

CVE-2026-32034

GHSA-3CVX-236H-M9FJ

Affected Products

Openclaw

References · 10

• https://github.com/openclaw/openclaw/commit/40a292619e1f2be3a3b1db663d7494c9c2dc0abf · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3cvx-236h-m9fj · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3cvx-236h-m9fj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32034 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/20684 · Note
• https://reddit.com/r/Pentesting/comments/1stprgd/we_let_an_llm_loose_on_opensource_apps_it_found_3 · Reddit Post
• https://twitter.com/CVEnew/status/2034891582680252832 · Twitter Post
• https://vulncheck.com/advisories/openclaw-insecure-control-ui-authentication-over-plaintext-http · Note