CVE-2026-32041: Auth Bypass in OpenClaw Node.js

An attacker exploiting this vulnerability could gain unauthorized access to browser-control routes within OpenClaw. This access could include the ability to execute evaluate-capable actions, potentially leading to remote code execution or data manipulation depending on the specific actions available through the browser-control interface. The vulnerability is particularly concerning because it can be exploited via a local process or through an SSRF (Server-Side Request Forgery) path, meaning an attacker doesn't necessarily need to be on the same network as the OpenClaw instance. Successful exploitation could allow an attacker to control the browser and potentially compromise the underlying system.

1. Reserved2026-03-10
2. Published2026-03-02
3. Modified2026-03-30
4. EPSS updated2026-03-27

The primary mitigation for CVE-2026-32041 is to upgrade OpenClaw to version 2026.3.1 or later. This version implements a fix that prevents startup if authentication bootstrapping fails, effectively closing off the unauthenticated access path. If upgrading is not immediately feasible, consider implementing strict network segmentation to limit SSRF access to the OpenClaw instance. Additionally, ensure that any existing authentication mechanisms are robust and properly configured. There are no specific WAF rules or detection signatures readily available, so focus on patching and network isolation.