Vulnerability · Published Mar 23, 2026 · Assigned by VulnCheck

CVE-2026-32913OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects

Critical 9.3

In plain English

A critical-severity security flaw in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.3%top 74.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intended for the original destination.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	openclaw	2026.3.7	GHSA-6mgf-v5j7-45cr

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw	0 – before 2026.3.7

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-6mgf-v5j7-45cr) vendor-advisory
Patch Commit patch
VulnCheck Advisory third-party-advisory