CVE-2026-32034
highpriority · track · 0OT risk · elevatedEPSS 0.004 · 34 %ileDEEUUSEPSS · scored 2026-10-27
OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is exposed over plaintext HTTP, allowing attackers to bypass device identity and pairing verification. An attacker with leaked or intercepted credentials can obtain high-privilege Control UI access by exploiting the lack of secure authentication enforcement over unencrypted HTTP connections.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.4–8.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0472OpenClaw: Mehrere SchwachstellenDeutsch2026-02-22csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.
- GHSA-3cvx-236h-m9fjOpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access2026-03-03ghsa · osvUS
## Description In affected releases, when an operator explicitly enabled `gateway.controlUi.allowInsecureAuth: true` and exposed the gateway over plaintext HTTP, Control UI authentication could permit privileged operator access without the intended device identity + pairing guarantees. This required an insecure deployment choice and credential exposure risk (for example, plaintext transit or prior token leak). It was fixed on `main` in commit `40a292619e1f2be3a3b1db663d7494c9c2dc0abf` ([PR #20684](https://github.com/openclaw/openclaw/pull/20684)). ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected published versions: `<= 2026.2.19-2` - Planned patched version: `2026.2.21` ## Impact In these explicitly insecure deployments, an attacker with leaked/intercepted credentials could obtain high-privilege Control UI access. ## Fix Commit(s) - `40a292619e1f2be3a3b1db663d7494c9c2dc0abf` (merged 2026-02-20) OpenClaw thanks @Vasco0x4 for reporting.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclaw/commit/40a292619e1f2be3a3b1db663d7494c9c2dc0abfcnnvd
- https://github.com/openclaw/openclaw/releasesPatchcnnvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3cvx-236h-m9fjcnnvd
- https://www.vulncheck.com/advisories/openclaw-insecure-control-ui-authentication-over-plaintext-cnnvd
- https://github.com/openclaw/openclaw/commit/40a292619e1f2be3a3b1db663d7494c9c2dc0abfenisa_euvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3cvx-236h-m9fjenisa_euvd
- https://www.vulncheck.com/advisories/openclaw-insecure-control-ui-authentication-over-plaintext-httpenisa_euvd
- https://github.com/openclaw/openclaw/commit/40a292619e1f2be3a3b1db663d7494c9c2dc0abfPatchnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan