CVE-2026-32913: Openclaw SSRF Vulnerability

CVE-2026-32913 Overview

CVE-2026-32913 is an improper header validation vulnerability in OpenClaw before version 2026.3.7 that allows attackers to intercept sensitive authorization headers through cross-origin redirect manipulation. The vulnerability exists in the fetchWithSsrFGuard function, which fails to properly strip custom authorization headers when following redirects to different origins. This enables attackers to capture sensitive headers such as X-Api-Key and Private-Token that were intended for the original destination.

Critical Impact

Attackers can trigger redirects to attacker-controlled origins to intercept sensitive authentication headers, potentially leading to unauthorized access to protected resources and credential theft.

Affected Products

• OpenClaw versions prior to 2026.3.7
• OpenClaw Node.js package (cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*)

Discovery Timeline

• 2026-03-23 - CVE-2026-32913 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-32913

Vulnerability Analysis

This vulnerability represents a Sensitive Data Exposure (CWE-522: Insufficiently Protected Credentials) issue in OpenClaw's fetch guard implementation. The core problem lies in how the application handles HTTP redirects across different origins. When a request is made to a trusted origin that subsequently redirects to a different (potentially malicious) origin, the application improperly forwards all custom authorization headers to the new destination.

The vulnerable code path in fetchWithSsrFGuard only stripped a limited set of standard sensitive headers (authorization, proxy-authorization, cookie, cookie2) during cross-origin redirects. However, many applications use custom headers for authentication purposes, such as X-Api-Key, Private-Token, or other vendor-specific authentication tokens. These custom headers were not sanitized during redirect handling, allowing them to leak to unintended recipients.

Root Cause

The root cause is an incomplete allowlist approach to header sanitization during cross-origin redirects. The original implementation used a denylist (CROSS_ORIGIN_REDIRECT_SENSITIVE_HEADERS) that only blocked four standard authentication headers. This approach failed to account for the wide variety of custom authentication headers used in modern applications.

The security patch addressed this by inverting the logic to use an allowlist approach (CROSS_ORIGIN_REDIRECT_SAFE_HEADERS), which explicitly defines which safe, non-sensitive headers are permitted to be forwarded during cross-origin redirects. All other headers, including any custom authentication headers, are now stripped by default.

Attack Vector

An attacker can exploit this vulnerability through a network-based attack requiring no authentication or user interaction. The attack scenario involves:

1. An attacker sets up a malicious server that they control
2. The attacker identifies a trusted endpoint that accepts user-controlled redirect parameters or can be manipulated to redirect
3. When a victim's OpenClaw application makes a request with sensitive custom headers to the trusted endpoint
4. The trusted endpoint redirects to the attacker-controlled server
5. The sensitive headers (X-Api-Key, Private-Token, etc.) are forwarded to the attacker's server

// Security patch in src/infra/net/fetch-guard.ts
// Source: https://github.com/openclaw/openclaw/commit/46715371b0612a6f9114dffd1466941ac476cef5

 >;
 
 const DEFAULT_MAX_REDIRECTS = 3;
-const CROSS_ORIGIN_REDIRECT_SENSITIVE_HEADERS = [
-  "authorization",
-  "proxy-authorization",
-  "cookie",
-  "cookie2",
-];
+const CROSS_ORIGIN_REDIRECT_SAFE_HEADERS = new Set([
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "cache-control",
+  "content-language",
+  "content-type",
+  "if-match",
+  "if-modified-since",
+  "if-none-match",
+  "if-unmodified-since",
+  "pragma",
+  "range",
+  "user-agent",
+]);
 
 export function withStrictGuardedFetchMode(params: GuardedFetchPresetOptions): GuardedFetchOptions {
   return { ...params, mode: GUARDED_FETCH_MODE.STRICT };

The fix transitions from a vulnerable denylist approach to a secure allowlist approach, ensuring only explicitly safe headers are forwarded during cross-origin redirects.

Detection Methods for CVE-2026-32913

Indicators of Compromise

• Outbound requests from OpenClaw applications containing custom authentication headers (X-Api-Key, Private-Token, etc.) to unexpected or untrusted domains
• Server logs showing redirect chains that terminate at external origins different from the initial request destination
• Unusual patterns of requests to endpoints known to issue redirects, particularly with authentication headers present

Detection Strategies

• Monitor HTTP traffic for requests that follow redirects across different origins while carrying custom authentication headers
• Implement network-level detection rules to alert on sensitive header patterns being sent to untrusted domains
• Review application logs for redirect sequences where the final destination origin differs from the initial request origin
• Deploy SentinelOne Singularity to detect and correlate suspicious network patterns associated with credential theft attempts

Monitoring Recommendations

• Enable verbose logging for the fetchWithSsrFGuard function to capture redirect handling events
• Implement alerting on outbound requests containing custom authentication headers to non-approved domains
• Regularly audit the list of trusted redirect destinations and cross-reference with actual traffic patterns
• Use SentinelOne's network visibility capabilities to track header exposure across application requests

How to Mitigate CVE-2026-32913

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.7 or later immediately
• Rotate any API keys, tokens, or credentials that may have been exposed through custom headers
• Review access logs for signs of unauthorized access using potentially compromised credentials
• Implement additional validation on redirect handling in custom code that uses OpenClaw

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.7. The security patch is available through the GitHub Commit Update. For complete details about the vulnerability and remediation, refer to the GitHub Security Advisory.

Workarounds

• Implement application-level redirect validation to prevent redirects to untrusted origins
• Configure network egress rules to block outbound requests to untrusted domains
• Use environment-specific proxy configurations that strip sensitive headers before forwarding to external destinations
• Consider disabling automatic redirect following and implementing manual redirect handling with proper header sanitization

# Configuration example - Update OpenClaw to patched version
npm update openclaw@2026.3.7

# Verify the installed version
npm list openclaw