CVE-2026-32913: Openclaw SSRF Vulnerability

CVE-2026-32913 Overview

CVE-2026-32913 is an improper header validation vulnerability in OpenClaw versions before 2026.3.7. The flaw resides in the fetchWithSsrFGuard function, which forwards custom authorization headers across cross-origin redirects without validating the destination. Attackers can host a malicious endpoint that issues an HTTP redirect to an attacker-controlled origin, causing OpenClaw to forward sensitive headers such as X-Api-Key and Private-Token to the new destination. The weakness maps to CWE-522: Insufficiently Protected Credentials and impacts confidentiality of credentials intended for trusted destinations.

Critical Impact
Cross-origin redirects can leak custom authorization headers (X-Api-Key, Private-Token) to attacker-controlled servers, enabling credential theft and downstream API compromise.

Affected Products

OpenClaw (Node.js package) versions prior to 2026.3.7
Applications embedding the fetchWithSsrFGuard helper from OpenClaw
Services relying on OpenClaw to proxy or relay outbound HTTP requests with custom auth headers

Discovery Timeline

2026-03-23 - CVE-2026-32913 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-32913

Vulnerability Analysis

The vulnerability stems from how fetchWithSsrFGuard handles HTTP redirect responses. When a target server returns a 3xx response with a Location header pointing to a different origin, the helper follows the redirect while preserving the original request headers. Custom authorization headers such as X-Api-Key and Private-Token remain attached to the follow-up request. Standard library behavior in well-designed HTTP clients strips credentials on cross-origin redirects to prevent exactly this class of leak. OpenClaw bypasses that safeguard, so any server an attacker can influence in a redirect chain receives the original caller's credentials. The exposure is most severe in proxy patterns where an application uses fetchWithSsrFGuard to call third-party APIs on behalf of users.

Root Cause

The root cause is missing origin comparison before re-attaching request headers on redirect. The function does not compare the scheme, host, and port of the redirect target against the original request and does not categorize X-Api-Key, Private-Token, Authorization, or other custom credential headers as sensitive material that must be dropped on cross-origin hops.

Attack Vector

An attacker who controls or compromises any endpoint that an OpenClaw consumer is willing to call can return a 302 redirect to a host they operate. The redirected request carries the caller's authorization headers verbatim. The attacker captures the headers in standard web server logs and replays them against the legitimate API. No authentication, user interaction, or local access is required, and the attack succeeds over the network.

The vulnerability is described in prose only; no verified proof-of-concept code is published. See the VulnCheck Advisory on OpenClaw for additional technical context.

Detection Methods for CVE-2026-32913

Indicators of Compromise

Outbound HTTP requests from OpenClaw hosts to unexpected external domains carrying X-Api-Key or Private-Token headers
3xx redirect responses in egress proxy or web application firewall logs where the Location header points to a different registrable domain than the original request
Unexpected API usage from third-party IP addresses authenticating with valid X-Api-Key or Private-Token values issued to internal services

Detection Strategies

Inventory all services using the openclaw Node.js package and identify versions older than 2026.3.7
Inspect outbound TLS-terminated egress traffic for redirect chains crossing organizational or vendor boundaries while custom auth headers are present
Correlate API key usage patterns against expected source ASNs and flag tokens observed from new origins after a redirect event

Monitoring Recommendations

Forward egress proxy logs and OpenClaw application logs into a centralized data lake and alert on cross-origin redirects that retain authorization headers
Enable per-key usage analytics on downstream APIs to detect anomalous geolocations or user agents using X-Api-Key or Private-Token credentials
Audit for use of fetchWithSsrFGuard in source repositories using static analysis and require updated library versions in CI gates

How to Mitigate CVE-2026-32913

Immediate Actions Required

Upgrade OpenClaw to version 2026.3.7 or later in all environments
Rotate any X-Api-Key, Private-Token, or equivalent credentials that may have been forwarded through fetchWithSsrFGuard to untrusted destinations
Restrict outbound network egress from OpenClaw hosts to a vetted allowlist of API endpoints

Patch Information

The maintainers fixed the issue in OpenClaw 2026.3.7. The fix is delivered in commit 46715371b0612a6f9114dffd1466941ac476cef5. Full details are published in GitHub Security Advisory GHSA-6mgf-v5j7-45cr.

Workarounds

Disable automatic redirect following in the HTTP client wrapper and handle 3xx responses explicitly in application code
Strip X-Api-Key, Private-Token, and Authorization headers from any request that resolves to a host outside the originally intended destination
Route all outbound OpenClaw traffic through an egress proxy that enforces destination allowlisting and removes sensitive headers on cross-origin redirects

bash

# Configuration example: pin OpenClaw to the patched version
npm install openclaw@2026.3.7 --save-exact
npm ls openclaw