CVE-2026-32041CWE-306

OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap

High · published March 19, 2026

CVSS v4.0
7.5
EPSS
0%
Percentile
6.4
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessible without authentication. Local processes or loopback-reachable SSRF paths can exploit this to access browser-control routes including evaluate-capable actions without valid credentials.

The record
Technical detail
CVSS v4.0
7.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00173 · 6.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-03-19T22:07Z
EPSS history
Timeline
  • 19 MAR 22:07Z
    OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap
    cvelistv5