CVE-2026-32041

MEDIUM

OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap

Title source: cna

Description

OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessible without authentication. Local processes or loopback-reachable SSRF paths can exploit this to access browser-control routes including evaluate-capable actions without valid credentials.

References (2)

[Third Party Advisory] https://github.com/openclaw/openclaw/security/advisories/GHSA-vpj2-69hf-rppw

[Third Party Advisory] https://www.vulncheck.com/advisories/openclaw-unauthenticated-browser-control-access-via-failed-auth-bootstrap

Scores

CVSS v3 6.9

EPSS 0.0002

EPSS Percentile 5.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-306

Status published

Products (3)

npm/openclaw 0 - 2026.3.1npm

OpenClaw/OpenClaw < 2026.3.1

OpenClaw/OpenClaw 2026.3.1

Published Mar 19, 2026

Tracked Since Mar 20, 2026