Medium severity5.9NVD Advisory· Published Mar 21, 2026· Updated Jun 17, 2026

CVE-2026-32045

Description

OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements. Attackers on trusted networks can exploit this misconfiguration to access HTTP gateway routes without proper authentication credentials.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	< 2026.2.21	2026.2.21

Affected products

OpenClaw/Openclaw2 versions
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.2.21
- (no CPE)range: 0
ghsa-coords
pkg:npm/openclaw
Range: < 2026.2.21

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/356d61aacfa5b0f1d5830716ec59d70682a3e7b8nvdPatchWEB
github.com/advisories/GHSA-hff7-ccv5-52f8ghsaADVISORY
github.com/openclaw/openclaw/security/advisories/GHSA-hff7-ccv5-52f8nvdMitigationVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-32045ghsaADVISORY
www.vulncheck.com/advisories/openclaw-authentication-bypass-in-http-gateway-routes-via-tokenless-tailscale-authnvdThird Party AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000