p PatchFirst

CVE-2026-32041

CVE-2026-32041 · OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessible without authentication. Local processes or loopback-reachable SSRF paths can exploit this to access browser-control routes including evaluate-capable actions without valid credentials.

CVSS 7.5 · High · EPSS 0.1% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • openclaw

    Versions
    • ≥ 0, < 2026.3.1: Affected (semver)
    • 2026.3.1: Not affected (semver)

    Update to 2026.3.1

  • openclaw npm

    Affected ranges
    • SEMVER: < 2026.3.1

    Update to 2026.3.1

Original sources

Check your server →