CVE-2026-32913 HIGH

CVE-2026-32913: OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects

Vendor Openclaw
Product OpenClaw
Weakness CWE-522 · Insufficiently protected credentials
Published March 23, 2026
Last update March 24, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intended for the original destination.

Key dates

02Disclosure timeline

March 23, 2026 CVE published
March 24, 2026 Record updated