CVE-2026-32045: OpenClaw auth bypass exposes HTTP

CISO Take

OpenClaw versions prior to 2026.2.21 misapply Tailscale's tokenless header authentication to HTTP gateway routes, allowing any attacker with presence on a trusted network to bypass token and password controls entirely. While High attack complexity limits opportunistic exploitation to insiders, compromised endpoints, or VPN-adjacent attackers, the High confidentiality impact is material for AI agent deployments where gateway routes may expose model inference endpoints, system prompts, agent tool configurations, and processed data. EPSS places this in the top 68th percentile of exploitation likelihood, and OpenClaw's history of 396 CVEs in the same package signals systemic security debt that elevates trust risk beyond this single finding. Upgrade to OpenClaw 2026.2.21 immediately using the patch at commit 356d61aa; if patching is blocked, restrict HTTP gateway ports via firewall ACLs and audit logs for anomalous unauthenticated requests to gateway routes.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium risk with context-dependent severity. The CVSS 5.9 score reflects High attack complexity — exploitation requires network presence within a Tailscale trust boundary — which meaningfully constrains the attack surface to insiders, compromised network nodes, or lateral movement from VPN-adjacent positions. However, the High confidentiality impact is significant for AI agent platforms where gateway routes serve as the control plane for inference proxying and tool invocation. No active exploitation, KEV listing, or public exploit code is present, and only 4 downstream dependents limit supply chain blast radius. The package's 396 historical CVEs represent a structural security posture concern that may justify architectural review beyond patching this individual issue.

How does the attack unfold?

Network Positioning

Attacker obtains presence on a Tailscale-trusted network segment via a compromised endpoint, insider access, or VPN lateral movement, then identifies an OpenClaw HTTP gateway instance via port scanning.

AML.T0006

Authentication Bypass

Attacker sends HTTP requests to OpenClaw gateway routes supplying Tailscale-derived headers without valid tokens or passwords, exploiting CWE-290 to pass authentication checks without legitimate credentials.

AML.T0049

Control Plane Access

With authentication bypassed, attacker gains unauthenticated access to the AI agent's HTTP gateway control plane including model inference endpoints and agent tool invocation APIs.

AML.T0040

Data Exfiltration

Attacker extracts sensitive data including model outputs, system prompts, agent configurations, and cached credentials, enabling further compromise of connected AI services and downstream systems.

AML.T0025

Network Positioning

Attacker obtains presence on a Tailscale-trusted network segment via a compromised endpoint, insider access, or VPN lateral movement, then identifies an OpenClaw HTTP gateway instance via port scanning.

AML.T0006

Authentication Bypass

Attacker sends HTTP requests to OpenClaw gateway routes supplying Tailscale-derived headers without valid tokens or passwords, exploiting CWE-290 to pass authentication checks without legitimate credentials.

AML.T0049

Control Plane Access

With authentication bypassed, attacker gains unauthenticated access to the AI agent's HTTP gateway control plane including model inference endpoints and agent tool invocation APIs.

AML.T0040

Data Exfiltration

Attacker extracts sensitive data including model outputs, system prompts, agent configurations, and cached credentials, enabling further compromise of connected AI services and downstream systems.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.2.21 or later — commit 356d61aa corrects the authentication logic for HTTP gateway routes.
Network controls: If patching is blocked, restrict access to OpenClaw HTTP gateway ports using host-based firewalls or network ACLs, allowing only explicitly authorized IP ranges.
Tailscale ACL review: Audit Tailscale policy to ensure the OpenClaw node's gateway routes require explicit authentication; add tag-based ACL rules to enforce auth at the network layer independent of application logic.
Detection: Review HTTP gateway access logs for requests lacking valid tokens or passwords that were permitted; correlate against Tailscale node connection events for anomalous peer access.
Temporary mitigation: Disable HTTP gateway routes if not operationally required until the patch is applied.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent API AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0091 - Use Alternate Authentication Material

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.3 - Access control for AI systems

NIST AI RMF

MANAGE 2.2 - AI risk treatment and response

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32045?

OpenClaw versions prior to 2026.2.21 misapply Tailscale's tokenless header authentication to HTTP gateway routes, allowing any attacker with presence on a trusted network to bypass token and password controls entirely. While High attack complexity limits opportunistic exploitation to insiders, compromised endpoints, or VPN-adjacent attackers, the High confidentiality impact is material for AI agent deployments where gateway routes may expose model inference endpoints, system prompts, agent tool configurations, and processed data. EPSS places this in the top 68th percentile of exploitation likelihood, and OpenClaw's history of 396 CVEs in the same package signals systemic security debt that elevates trust risk beyond this single finding. Upgrade to OpenClaw 2026.2.21 immediately using the patch at commit 356d61aa; if patching is blocked, restrict HTTP gateway ports via firewall ACLs and audit logs for anomalous unauthenticated requests to gateway routes.

Is CVE-2026-32045 actively exploited?

No confirmed active exploitation of CVE-2026-32045 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32045?

1. Patch: Upgrade OpenClaw to 2026.2.21 or later — commit 356d61aa corrects the authentication logic for HTTP gateway routes. 2. Network controls: If patching is blocked, restrict access to OpenClaw HTTP gateway ports using host-based firewalls or network ACLs, allowing only explicitly authorized IP ranges. 3. Tailscale ACL review: Audit Tailscale policy to ensure the OpenClaw node's gateway routes require explicit authentication; add tag-based ACL rules to enforce auth at the network layer independent of application logic. 4. Detection: Review HTTP gateway access logs for requests lacking valid tokens or passwords that were permitted; correlate against Tailscale node connection events for anomalous peer access. 5. Temporary mitigation: Disable HTTP gateway routes if not operationally required until the patch is applied.

What systems are affected by CVE-2026-32045?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, API gateways.

What is the CVSS score for CVE-2026-32045?

CVE-2026-32045 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servingAPI gateways

MITRE ATLAS Techniques

AML.T0040 AI Model Inference API Access

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0091 Use Alternate Authentication Material

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements. Attackers on trusted networks can exploit this misconfiguration to access HTTP gateway routes without proper authentication credentials.

Exploitation Scenario

An attacker with a foothold on a Tailscale-connected network — via a compromised employee workstation, rogue contractor, or lateral movement from an adjacent VPN segment — identifies a running OpenClaw deployment by scanning for its default HTTP gateway port. They craft HTTP requests targeting the gateway routes, supplying only Tailscale-derived headers but omitting authentication tokens or passwords. Due to the authentication misconfiguration (CWE-290), OpenClaw treats these requests as authenticated and grants full gateway access. The attacker proceeds to enumerate available agent tools, invoke model inference endpoints, retrieve system prompt configurations, and extract any credentials or API keys the agent has cached — capabilities directly analogous to the abuse documented in AIID #1368 where OpenClaw's ecosystem was leveraged for credential exfiltration.

Weaknesses (CWE)

CWE-290 Authentication Bypass by Spoofing

CWE-290 — Authentication Bypass by Spoofing: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Source: MITRE CWE corpus.