CVE-2026-32913: OpenClaw auth header leak

CISO Take

OpenClaw before 2026.3.7 improperly forwards custom authorization headers — including X-Api-Key and Private-Token — to attacker-controlled destinations when its fetchWithSsrFGuard function follows cross-origin HTTP redirects, exposing API credentials with no authentication or user interaction required (CVSS 9.3, AV:N/AC:L/PR:N/UI:N). For AI agent deployments this is disproportionately dangerous: OpenClaw agents routinely carry high-value keys for LLM providers, vector databases, and internal tooling, so a single planted redirect can cascade into full compromise of every connected AI service. The EPSS score places this in the top 77th percentile for exploitation likelihood, the scope-changed CVSS (S:C) means impact propagates beyond the agent itself, and AIID incident #1368 already documented active credential theft within the OpenClaw skills ecosystem in early 2026 — the same platform and attacker objective. Upgrade to 2026.3.7 immediately, rotate all API keys the agent uses, and audit HTTP logs for cross-origin redirect chains predating the patch.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CRITICAL. The combination of network-reachable, zero-privilege, zero-interaction exploitation with a scope change (S:C, C:H) means a remote attacker can harvest high-privilege AI service credentials at scale with no foothold on the victim organization. In AI agent contexts the blast radius multiplies: a single OpenClaw deployment typically holds keys for multiple upstream AI services, and stolen tokens grant authenticated access to those services with the full privilege level of the agent. The 396 CVEs in the same package suggest systemic security debt, and the documented real-world abuse of the OpenClaw skills ecosystem (AIID #1368) confirms active attacker interest in this platform.

How does the attack unfold?

Position Redirect

Attacker plants a redirect at a URL the OpenClaw agent is expected to fetch — via RAG index poisoning, compromising an external data feed, or modifying tool configuration — pointing to an attacker-controlled server.

AML.T0049

Credential Interception

OpenClaw's fetchWithSsrFGuard follows the cross-origin redirect while forwarding the original X-Api-Key, Private-Token, or Authorization headers to the attacker's server, exposing credentials in plaintext HTTP request headers.

AML.T0106

Credential Validation

Attacker tests harvested API keys against LLM provider endpoints and internal AI platform APIs to identify valid credentials and their privilege scope before full exploitation.

AML.T0055

Lateral Movement and Impact

With valid credentials, attacker authenticates to connected AI services as the compromised agent — exfiltrating RAG database contents, running expensive LLM inference at victim cost, accessing proprietary model outputs, or pivoting to internal systems that trust the stolen token.

AML.T0012

Position Redirect

Attacker plants a redirect at a URL the OpenClaw agent is expected to fetch — via RAG index poisoning, compromising an external data feed, or modifying tool configuration — pointing to an attacker-controlled server.

AML.T0049

Credential Interception

OpenClaw's fetchWithSsrFGuard follows the cross-origin redirect while forwarding the original X-Api-Key, Private-Token, or Authorization headers to the attacker's server, exposing credentials in plaintext HTTP request headers.

AML.T0106

Credential Validation

Attacker tests harvested API keys against LLM provider endpoints and internal AI platform APIs to identify valid credentials and their privilege scope before full exploitation.

AML.T0055

Lateral Movement and Impact

With valid credentials, attacker authenticates to connected AI services as the compromised agent — exfiltrating RAG database contents, running expensive LLM inference at victim cost, accessing proprietary model outputs, or pivoting to internal systems that trust the stolen token.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

9.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I Low

A None

What should I do?

6 steps

Patch immediately: upgrade OpenClaw to 2026.3.7 (patch commit 46715371 in the GitHub advisory).
Rotate all API keys and tokens that OpenClaw agents use, prioritizing LLM provider keys and internal platform tokens.
If immediate patching is not possible, configure a proxy or WAF rule to strip Authorization, X-Api-Key, and Private-Token headers on any HTTP response that triggers a cross-origin redirect from OpenClaw traffic.
Audit HTTP request logs for redirect chains crossing origin boundaries in the window before patching.
Scope API keys to minimum necessary permissions and set short expiration windows to limit the stolen-credential window.
Review OpenClaw agent tool definitions to ensure no attacker-controllable data sources (RAG indexes, external feeds) can inject redirect targets into the fetch path.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Data Leakage Agent API Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0055 - Unsecured Credentials AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.4 - Access to systems and applications

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-32913?

OpenClaw before 2026.3.7 improperly forwards custom authorization headers — including X-Api-Key and Private-Token — to attacker-controlled destinations when its fetchWithSsrFGuard function follows cross-origin HTTP redirects, exposing API credentials with no authentication or user interaction required (CVSS 9.3, AV:N/AC:L/PR:N/UI:N). For AI agent deployments this is disproportionately dangerous: OpenClaw agents routinely carry high-value keys for LLM providers, vector databases, and internal tooling, so a single planted redirect can cascade into full compromise of every connected AI service. The EPSS score places this in the top 77th percentile for exploitation likelihood, the scope-changed CVSS (S:C) means impact propagates beyond the agent itself, and AIID incident #1368 already documented active credential theft within the OpenClaw skills ecosystem in early 2026 — the same platform and attacker objective. Upgrade to 2026.3.7 immediately, rotate all API keys the agent uses, and audit HTTP logs for cross-origin redirect chains predating the patch.

Is CVE-2026-32913 actively exploited?

No confirmed active exploitation of CVE-2026-32913 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32913?

1. Patch immediately: upgrade OpenClaw to 2026.3.7 (patch commit 46715371 in the GitHub advisory). 2. Rotate all API keys and tokens that OpenClaw agents use, prioritizing LLM provider keys and internal platform tokens. 3. If immediate patching is not possible, configure a proxy or WAF rule to strip Authorization, X-Api-Key, and Private-Token headers on any HTTP response that triggers a cross-origin redirect from OpenClaw traffic. 4. Audit HTTP request logs for redirect chains crossing origin boundaries in the window before patching. 5. Scope API keys to minimum necessary permissions and set short expiration windows to limit the stolen-credential window. 6. Review OpenClaw agent tool definitions to ensure no attacker-controllable data sources (RAG indexes, external feeds) can inject redirect targets into the fetch path.

What systems are affected by CVE-2026-32913?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, RAG pipelines, LLM API integrations, Model serving.

What is the CVSS score for CVE-2026-32913?

CVE-2026-32913 has a CVSS v3.1 base score of 9.3 (CRITICAL). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksRAG pipelinesLLM API integrationsModel serving

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0055 Unsecured Credentials

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.9.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intended for the original destination.

Exploitation Scenario

An adversary identifies an organization running OpenClaw agents that fetch external URLs as part of a RAG retrieval or agentic tool execution flow. The attacker poisons a RAG-indexed data source or compromises a third-party feed the agent consumes, embedding a URL that the agent will fetch and that redirects to an attacker-controlled server. When the agent's fetchWithSsrFGuard follows the redirect, it forwards the original X-Api-Key and Private-Token headers to the attacker's server. The attacker now holds valid credentials for the organization's LLM provider, vector database, or internal AI platform — enabling model output exfiltration, expensive inference at the victim's cost, RAG database access, or lateral movement to internal systems that trust the stolen token.

Weaknesses (CWE)

CWE-522 Insufficiently Protected Credentials

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.