PT-2026-32294 · Npm · Openclaw

Published 2026-04-03 · Updated 2026-04-03

OSV

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

Media download follows cross-origin redirects with Authorization headers intact

Current Maintainer Triage

• Status: open
• Normalized severity: medium
• Assessment: Shipped v2026.3.28 media downloads forwarded Authorization across cross-origin redirects, a real in-scope credential-leak class that fits medium.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published npm version: 2026.3.31
• Vulnerable version range: <=2026.3.28
• Patched versions: >= 2026.3.31
• First stable tag containing the fix: v2026.3.31

Fix Commit(s)

• e704323ff388ed21f6963f9b8e0b1b8dfaaabc5f — 2026-03-31T19:57:42+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

GHSA-68V4-HMWV-F43H

Affected Products

Openclaw

References · 5

• https://osv.dev/vulnerability/GHSA-68v4-hmwv-f43h · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/e704323ff388ed21f6963f9b8e0b1b8dfaaabc5f · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-68v4-hmwv-f43h · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note