CVE-2026-32034CWE-78

OpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP

Medium · published March 19, 2026

CVSS v4.0
6.1
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is exposed over plaintext HTTP, allowing attackers to bypass device identity and pairing verification. An attacker with leaked or intercepted credentials can obtain high-privilege Control UI access by exploiting the lack of secure authentication enforcement over unencrypted HTTP connections.

The record
Technical detail
CVSS v4.0
6.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00764 · 54.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-19T22:07Z
EPSS history
Timeline
  • 19 MAR 22:07Z
    OpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP
    cvelistv5