CVE-2026-32045: Openclaw Auth Bypass Vulnerability

CVE-2026-32045 Overview

CVE-2026-32045 is an authentication bypass vulnerability affecting OpenClaw versions prior to 2026.2.21. The vulnerability stems from incorrect application of tokenless Tailscale header authentication to HTTP gateway routes, allowing attackers to bypass token and password requirements. Attackers positioned on trusted networks can exploit this misconfiguration to access HTTP gateway routes without providing proper authentication credentials.

Critical Impact
Attackers on trusted networks can bypass authentication entirely, gaining unauthorized access to protected HTTP gateway routes without valid tokens or passwords.

Affected Products

OpenClaw versions prior to 2026.2.21
OpenClaw Node.js deployments with HTTP gateway routes enabled
Systems utilizing Tailscale header authentication

Discovery Timeline

2026-03-21 - CVE-2026-32045 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-32045

Vulnerability Analysis

This vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing). The core issue lies in how OpenClaw applies tokenless Tailscale header authentication across different route types. Rather than requiring explicit token or password validation for all HTTP gateway routes, the application incorrectly trusts network-level authentication headers when processing gateway requests.

The flaw enables attackers who have access to trusted networks (such as internal networks or VPN segments where Tailscale operates) to craft requests that bypass the intended authentication layer. By exploiting the misconfigured trust relationship between Tailscale headers and the gateway routing logic, unauthorized users can access protected resources that should require explicit credential validation.

Root Cause

The root cause is improper authentication validation in the HTTP gateway route handling code. OpenClaw's implementation fails to enforce token or password requirements when Tailscale headers indicate a trusted network context. This creates an implicit trust assumption that network-level identity verification is sufficient for all route types, which contradicts secure authentication design principles.

Attack Vector

The attack requires network access to the trusted network segment where Tailscale authentication headers are accepted. An attacker positioned on such a network can send HTTP requests to gateway routes without providing valid authentication tokens or passwords. The vulnerable application accepts these requests based solely on the presence of Tailscale authentication headers, granting access to protected functionality.

The network-based attack vector requires some level of initial positioning (access to the trusted network), but once achieved, exploitation requires minimal complexity. No user interaction is required, and the attacker needs no prior privileges within the application itself.

Detection Methods for CVE-2026-32045

Indicators of Compromise

Unusual access patterns to HTTP gateway routes from network segments that should not have direct access
Authentication logs showing successful gateway access without corresponding token validations
Requests to protected endpoints lacking standard authentication headers while containing only Tailscale-related headers

Detection Strategies

Monitor HTTP gateway route access logs for requests that lack token-based authentication but were still permitted
Implement alerting for access patterns from internal networks that deviate from established baselines
Review authentication audit trails for discrepancies between expected credential verification events and actual access grants

Monitoring Recommendations

Enable verbose logging on HTTP gateway routes to capture authentication decision details
Deploy network traffic analysis to identify requests exploiting the header authentication bypass
Correlate gateway access events with identity provider authentication records to detect unauthorized access

How to Mitigate CVE-2026-32045

Immediate Actions Required

Upgrade OpenClaw to version 2026.2.21 or later immediately
Review access logs for any evidence of unauthorized gateway route access
Audit current network segmentation to identify potentially exposed trusted network segments
Consider temporarily disabling tokenless Tailscale authentication on HTTP gateway routes until patching is complete

Patch Information

The OpenClaw development team has released a security patch addressing this vulnerability. The fix is available in version 2026.2.21 and later. The patch ensures that token and password requirements are properly enforced on HTTP gateway routes regardless of Tailscale header authentication status. For detailed technical changes, refer to the GitHub commit and the GitHub Security Advisory.

Workarounds

Implement network-level access controls to restrict which hosts can reach HTTP gateway routes
Add an additional authentication proxy layer in front of OpenClaw gateway endpoints
Temporarily disable HTTP gateway routes if they are not business-critical until patching can be completed
Configure web application firewall rules to require explicit authentication headers on gateway route requests

bash

# Example: Update OpenClaw to patched version
npm update openclaw@2026.2.21

# Verify installed version
npm list openclaw