PT-2026-26422 · Openclaw · Openclaw

Teipete · Published 2026-03-02 · Updated 2026-04-09 · CVE-2026-32041

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1

Description OpenClaw does not correctly manage authentication bootstrap errors during startup, which can allow browser-control routes to remain accessible without authentication. Local processes or loopback-reachable Server-Side Request Forgery (SSRF) paths can exploit this to access browser-control routes, including actions capable of evaluating code, without valid credentials. The software attempted to automatically bootstrap authentication when browser control started without explicit credentials. If this bootstrap process failed, startup continued, exposing browser-control routes without authentication.

Recommendations Update to version 2026.3.1 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-32041

GHSA-VPJ2-69HF-RPPW

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-vpj2-69hf-rppw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32041 · Security Note
• https://osv.dev/vulnerability/GHSA-vpj2-69hf-rppw · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/pulsepatchio/status/2038634461131411872 · Twitter Post
• https://vulncheck.com/advisories/openclaw-unauthenticated-browser-control-access-via-failed-auth-bootstrap · Note
• https://twitter.com/CVEnew/status/2034891576166486407 · Twitter Post
• https://twitter.com/dailycve/status/2042312495654727972 · Twitter Post