sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-32041 OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap

High 7.5 Published Updated

Attackers can bypass authentication to access browser-control routes and execute code via SSRF or local access due to improper error handling during startup.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Local or same network only
Victim action needed
Not needed
Fix
Available

What is CVE-2026-32041?

CVE-2026-32041 is a high-severity authentication bypass vulnerability in Openclaw Openclaw, published on 19 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowing browser-control routes to remain accessible without authentication. Local processes or loopback-reachable SSRF paths can exploit this to access browser-control routes including evaluate-capable actions without valid credentials.

Weakness: CWE-306

Which versions are affected by CVE-2026-32041?

2 open source packages ship an affected version, including openclaw. It affects 1 product.

PackageAffectedFixed in
openclaw npmAll versions2026.3.1
openclaw npmAll versions2026.3.1

Products include Openclaw Openclaw.

How do I fix CVE-2026-32041?

Upgrade openclaw to 2026.3.1 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-32041 being exploited?

There is no known exploitation of CVE-2026-32041 in the wild and no public exploit code.

All Openclaw Openclaw vulnerabilities

Sources

Also known as GHSA-vpj2-69hf-rppw, MINI-cx3q-rqhf-chqw.

Is CVE-2026-32041 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free