CVE-2026-32045CWE-290

OpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale Auth

High · published March 21, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements. Attackers on trusted networks can exploit this misconfiguration to access HTTP gateway routes without proper authentication credentials.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00595 · 47.8th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-03-21T00:42Z
EPSS history
Timeline
  • 21 MAR 00:42Z
    OpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale Auth
    cvelistv5