PT-2026-26728 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-03 · Updated 2026-03-21 · CVE-2026-32045

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.21

Description The software incorrectly applies tokenless Tailscale header authentication to HTTP gateway routes. This allows bypassing token and password requirements for attackers on trusted networks, granting them access to HTTP gateway routes without proper authentication. The issue affects HTTP gateway routes specifically.

Recommendations Update to version 2026.2.21 or later.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-32045

GHSA-HFF7-CCV5-52F8

GHSA-QWMF-95R9-GX9X

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-hff7-ccv5-52f8 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/356d61aacfa5b0f1d5830716ec59d70682a3e7b8 · Patch
• https://osv.dev/vulnerability/GHSA-qwmf-95r9-gx9x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32045 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hff7-ccv5-52f8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32045 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2035262089619439757 · Twitter Post
• https://vulncheck.com/advisories/openclaw-authentication-bypass-in-http-gateway-routes-via-tokenless-tailscale-auth · Note