Which versions of Openclaw are affected by CVE-2026-32034?

CVE-2026-32034 presents moderate security risk, a OS command injection vulnerability rated CVSS 6.1. Exploitation could allow attackers to execute code or inject malicious input.. A patch is available.

How to fix or mitigate CVE-2026-32034?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Openclaw CVE-2026-32034

Q: What is the CVSS score of CVE-2026-32034?

CVE-2026-32034 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

OS Command Injection (CWE-78)

2026-03-19 disclosure@vulncheck.com

GHSA-3cvx-236h-m9fj

Authentication Bypass Command Injection Openclaw

6.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 22:30 vuln.today

CVE Published

Mar 19, 2026 - 22:16 nvd

MEDIUM 6.1

DescriptionCVE.org

OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is exposed over plaintext HTTP, allowing attackers to bypass device identity and pairing verification. An attacker with leaked or intercepted credentials can obtain high-privilege Control UI access by exploiting the lack of secure authentication enforcement over unencrypted HTTP connections.

AnalysisAI

OpenClaw versions before 2026.2.21 allow authenticated attackers to bypass device identity verification and gain high-privilege Control UI access when insecure authentication is enabled and the gateway uses unencrypted HTTP. An attacker with compromised credentials can exploit the lack of secure authentication enforcement to obtain unauthorized control access. The vulnerability requires network access and valid credentials but poses significant risk in environments where plaintext HTTP is used.

Technical ContextAI

The vulnerability exists in OpenClaw's Control UI authentication mechanism and stems from improper enforcement of secure authentication channels (CWE-78: Improper Neutralization of Special Elements used in an OS Command). When the allowInsecureAuth configuration option is explicitly enabled, the system fails to enforce cryptographic protections for authentication tokens and credentials transmitted over plaintext HTTP. This creates a situation where an attacker on the network path (or with intercepted credentials) can replay or forge authentication requests without proper verification of device identity or pairing status. The root cause is the conditional trust in unencrypted HTTP channels when a dangerous configuration flag is set, violating secure-by-default principles and allowing credential-based lateral movement to high-privilege Control UI endpoints.

RemediationAI

Upgrade OpenClaw to version 2026.2.21 or later immediately, referencing the official GitHub Security Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-3cvx-236h-m9fj for patching details. Until patching is completed, apply the following compensating controls: disable the allowInsecureAuth configuration flag entirely (enforce it to false via policy or environment defaults), enforce HTTPS-only access to the Control UI via reverse proxy with HSTS header enforcement, implement network segmentation to restrict gateway exposure to trusted internal networks only, and audit all configuration instances of allowInsecureAuth across your deployment to identify and remediate any deviation from secure defaults. If HTTP exposure cannot be immediately removed, implement network-level controls such as VPN enforcement or IP whitelisting to prevent unauthorized credential interception.