CVE-2026-32913

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32913
OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intended for the original destination.

9.3 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/openclaw/openclaw/commit/46715371b0612a6f9114dffd1466941ac476cef5 Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-6mgf-v5j7-45cr Vendor Advisory
https://vulncheck.com/advisories/openclaw-mar-custom-authorization-header-leakage-via-cross-origin-redirects Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
History

24 Mar 2026, 18:01

Type Values Removed Values Added
References () https://github.com/openclaw/openclaw/commit/46715371b0612a6f9114dffd1466941ac476cef5 - () https://github.com/openclaw/openclaw/commit/46715371b0612a6f9114dffd1466941ac476cef5 - Patch
References () https://github.com/openclaw/openclaw/security/advisories/GHSA-6mgf-v5j7-45cr - () https://github.com/openclaw/openclaw/security/advisories/GHSA-6mgf-v5j7-45cr - Vendor Advisory
References () https://vulncheck.com/advisories/openclaw-mar-custom-authorization-header-leakage-via-cross-origin-redirects - () https://vulncheck.com/advisories/openclaw-mar-custom-authorization-header-leakage-via-cross-origin-redirects - Third Party Advisory
CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
Summary
  • (es) OpenClaw anterior a 2026.3.7 contiene una vulnerabilidad de validación de encabezado indebida en fetchWithSsrFGuard que reenvía encabezados de autorización personalizados a través de redirecciones de origen cruzado. Los atacantes pueden desencadenar redirecciones a diferentes orígenes para interceptar encabezados sensibles como X-Api-Key y Private-Token destinados al destino original.
First Time Openclaw openclaw
Openclaw

23 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-23 22:16

Updated : 2026-03-24 18:01

NVD link : CVE-2026-32913

Mitre link : CVE-2026-32913

CVE.ORG link : CVE-2026-32913

JSON object : View

Products Affected

openclaw

  • openclaw
CWE
CWE-522

Insufficiently Protected Credentials