CVE-2026-32041: OpenClaw auth bypass exposes

CISO Take

CVE-2026-32041 affects OpenClaw AI agent framework versions prior to 2026.3.1, where a failure to handle authentication bootstrap errors leaves browser-control routes—including JavaScript evaluate-capable endpoints—accessible without credentials on the local interface. While the attack vector is technically local, the real risk lies in SSRF chaining: any co-located web application with a server-side request forgery flaw can relay requests to the agent's loopback interface, converting a local bug into a remotely exploitable primitive that requires no privileges whatsoever. The EPSS score places this vulnerability in the 98th percentile for exploitation likelihood across tracked CVEs, and OpenClaw's history of 396 prior CVEs signals a package with persistent security debt that adversaries actively probe. Organizations should upgrade to OpenClaw 2026.3.1 immediately; if patching is delayed, restrict loopback TCP access to the agent's control port via host-level firewall rules and audit any SSRF exposure in web applications sharing the same host.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium-rated by CVSS (6.9) but contextually elevated for AI agent deployments. The AV:L classification understates real-world risk in modern agentic stacks where SSRF vulnerabilities in co-located web applications are common and can bridge the loopback gap. No privileges are required, lowering the exploitation bar significantly for any attacker with local or SSRF foothold. The evaluate-capable browser-control endpoint represents a code execution primitive within the agent's trust boundary—comparable in impact to RCE for any read/write operations the agent is authorized to perform. The 98th percentile EPSS ranking and 396 prior package CVEs suggest this package is actively targeted and carries systemic security technical debt.

How does the attack unfold?

Initial Access

Attacker identifies loopback-accessible browser-control port via SSRF in a co-located web application, or gains local process access to the host running OpenClaw.

AML.T0049

Authentication Bypass

Requests reach OpenClaw's browser-control routes during the authentication bootstrap failure window; CWE-306 leaves the endpoint accessible without valid credentials, requiring no privileges.

AML.T0112.000

Arbitrary Tool Invocation

Attacker invokes evaluate-capable browser-control actions unauthenticated, gaining JavaScript execution within the agent's managed browser context.

AML.T0053

Credential Harvest & Exfiltration

Attacker extracts session cookies, credentials, and sensitive data from authenticated browser sessions managed by the OpenClaw agent, or redirects agent actions to perform unauthorized operations on connected systems.

AML.T0083

Initial Access

Attacker identifies loopback-accessible browser-control port via SSRF in a co-located web application, or gains local process access to the host running OpenClaw.

AML.T0049

Authentication Bypass

Requests reach OpenClaw's browser-control routes during the authentication bootstrap failure window; CWE-306 leaves the endpoint accessible without valid credentials, requiring no privileges.

AML.T0112.000

Arbitrary Tool Invocation

Attacker invokes evaluate-capable browser-control actions unauthenticated, gaining JavaScript execution within the agent's managed browser context.

AML.T0053

Credential Harvest & Exfiltration

Attacker extracts session cookies, credentials, and sensitive data from authenticated browser sessions managed by the OpenClaw agent, or redirects agent actions to perform unauthorized operations on connected systems.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.9 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 2% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR None

UI None

S Unchanged

C High

I High

A Low

What should I do?

5 steps

Patch: Upgrade to OpenClaw 2026.3.1 or later immediately.
Network isolation: Restrict access to the agent's browser-control port (typically bound to loopback) using host firewall rules (iptables/nftables) to allow only the agent process's own UID.
SSRF hardening: Audit all web applications running on the same host for SSRF vulnerabilities that could reach the agent's control interface; block outbound requests to 127.0.0.0/8 from web application processes.
Detection: Monitor for unexpected HTTP requests to the agent's control port from processes other than OpenClaw itself; alert on evaluate endpoint invocations during or shortly after agent startup.
Process isolation: Run OpenClaw in a dedicated container or VM to reduce SSRF blast radius and limit lateral movement if exploited.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0006 - Active Scanning AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.4 - AI system security

NIST AI RMF

GOVERN 1.3 - Organizational practices are in place to enable AI risk management

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32041?

CVE-2026-32041 affects OpenClaw AI agent framework versions prior to 2026.3.1, where a failure to handle authentication bootstrap errors leaves browser-control routes—including JavaScript evaluate-capable endpoints—accessible without credentials on the local interface. While the attack vector is technically local, the real risk lies in SSRF chaining: any co-located web application with a server-side request forgery flaw can relay requests to the agent's loopback interface, converting a local bug into a remotely exploitable primitive that requires no privileges whatsoever. The EPSS score places this vulnerability in the 98th percentile for exploitation likelihood across tracked CVEs, and OpenClaw's history of 396 prior CVEs signals a package with persistent security debt that adversaries actively probe. Organizations should upgrade to OpenClaw 2026.3.1 immediately; if patching is delayed, restrict loopback TCP access to the agent's control port via host-level firewall rules and audit any SSRF exposure in web applications sharing the same host.

Is CVE-2026-32041 actively exploited?

No confirmed active exploitation of CVE-2026-32041 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32041?

1. Patch: Upgrade to OpenClaw 2026.3.1 or later immediately. 2. Network isolation: Restrict access to the agent's browser-control port (typically bound to loopback) using host firewall rules (iptables/nftables) to allow only the agent process's own UID. 3. SSRF hardening: Audit all web applications running on the same host for SSRF vulnerabilities that could reach the agent's control interface; block outbound requests to 127.0.0.0/8 from web application processes. 4. Detection: Monitor for unexpected HTTP requests to the agent's control port from processes other than OpenClaw itself; alert on evaluate endpoint invocations during or shortly after agent startup. 5. Process isolation: Run OpenClaw in a dedicated container or VM to reduce SSRF blast radius and limit lateral movement if exploited.

What systems are affected by CVE-2026-32041?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser automation agents, agentic AI pipelines, local AI agent deployments.

What is the CVSS score for CVE-2026-32041?

CVE-2026-32041 has a CVSS v3.1 base score of 6.9 (MEDIUM). The EPSS exploitation probability is 0.11%.

What is the AI security impact?

Affected AI Architectures

agent frameworksbrowser automation agentsagentic AI pipelineslocal AI agent deployments

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.8.4

NIST AI RMF: GOVERN 1.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessible without authentication. Local processes or loopback-reachable SSRF paths can exploit this to access browser-control routes including evaluate-capable actions without valid credentials.

Exploitation Scenario

An adversary targeting an organization that uses OpenClaw for automated browser tasks identifies a co-located web application with an SSRF vulnerability. During or shortly after OpenClaw startup—when authentication fails to initialize correctly—the adversary crafts an SSRF payload pointing to the agent's loopback browser-control endpoint and invokes the evaluate action with arbitrary JavaScript. This allows the attacker to extract session cookies, capture credentials from authenticated browser sessions the agent is managing (such as enterprise SaaS logins or internal dashboards), or redirect the agent to perform unauthorized actions within those authenticated sessions—all without ever presenting valid OpenClaw credentials.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.