CVE-2026-32913

CRITICAL

OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-32913. PoCs published by Rickidevs.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-32913, an information leakage vulnerability in OpenClaw's `fetchWithSsrFGuard()` function. The issue arises from an incomplete denylist of sensitive headers during cross-origin redirects, allowing custom authorization headers to be forwarded to attacker-controlled destinations.

Description

OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intended for the original destination.

Exploits (1)

nomisec WRITEUP
by Rickidevs · poc
https://github.com/Rickidevs/CVE-2026-32913

This repository provides a detailed technical analysis of CVE-2026-32913, an information leakage vulnerability in OpenClaw's `fetchWithSsrFGuard()` function. The issue arises from an incomplete denylist of sensitive headers during cross-origin redirects, allowing custom authorization headers to be forwarded to attacker-controlled destinations.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: OpenClaw <= 2026.3.2
No auth needed
Prerequisites: Attacker-controlled redirect destination · Victim application using OpenClaw with custom authorization headers
devstral-2 · analyzed Mar 24, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 9.3
EPSS 0.0004
EPSS Percentile 14.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-522
Status published
Products (4)
npm/openclaw 0 - 2026.3.7npm
OpenClaw/OpenClaw < 2026.3.7
openclaw/openclaw < 2026.3.7
OpenClaw/OpenClaw 2026.3.7
Published Mar 23, 2026
Tracked Since Mar 24, 2026