What is the CVSS score of CVE-2026-32041?

CVE-2026-32041 has a CVSS 3.1 base score of 6.9 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-32041?

CVE-2026-32041 presents notable security risk, a missing authentication vulnerability rated CVSS 6.9. This could allow unauthorized access to protected resources.. A patch is available.

How to fix or mitigate CVE-2026-32041?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Openclaw CVE-2026-32041

MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-03-19 disclosure@vulncheck.com

GHSA-vpj2-69hf-rppw

SSRF Authentication Bypass Openclaw

6.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 22:30 vuln.today

CVE Published

Mar 19, 2026 - 22:16 nvd

MEDIUM 6.9

DescriptionCVE.org

OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessible without authentication. Local processes or loopback-reachable SSRF paths can exploit this to access browser-control routes including evaluate-capable actions without valid credentials.

AnalysisAI

OpenClaw versions prior to 2026.3.1 contain an authentication bypass vulnerability where failed authentication bootstrap during startup leaves browser-control routes accessible without credentials. An attacker with local process access or ability to reach the application via loopback SSRF can exploit this to access sensitive browser-control functionality including code evaluation capabilities without valid authentication. This is a moderate-risk vulnerability with a CVSS score of 6.9 and realistic exploitation potential for local/SSRF-capable threats.

Technical ContextAI

The vulnerability exists in OpenClaw's authentication bootstrap mechanism, which fails to properly validate and enforce authentication state during application startup. The root cause is classified under CWE-306 (Missing Authentication for Critical Function), indicating that browser-control routes—which likely handle sensitive operations such as JavaScript evaluation and browser automation—are not adequately protected when the authentication system encounters errors during initialization. The affected routes remain in an unauthenticated state if bootstrap fails, exposing critical functionality. The attack vector targets the application via local network access (loopback or SSRF-reachable paths), meaning an attacker need not have direct network access from a remote system but can exploit the vulnerability through local processes or server-side request forgery vulnerabilities elsewhere in the infrastructure.

RemediationAI

Upgrade OpenClaw to version 2026.3.1 or later immediately to resolve the authentication bootstrap vulnerability. This patch version addresses the improper error handling and ensures browser-control routes enforce authentication even when bootstrap encounters errors. Until patching is possible, implement network-level mitigations by restricting loopback access to the OpenClaw application to trusted local processes only, and audit any SSRF-vulnerable applications or services that could reach the OpenClaw instance to ensure they cannot be exploited to reach browser-control routes. Additionally, implement network segmentation to prevent untrusted local processes from accessing the OpenClaw service. Refer to the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-vpj2-69hf-rppw for patch availability and deployment guidance.