CVE-2026-41345 MEDIUM

CVE-2026-41345: OpenClaw < 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media Download

Vendor Openclaw
Product OpenClaw
Weakness CWE-522 · Insufficiently protected credentials
Published April 23, 2026
Last update April 24, 2026
View on NVD All CVEs

CVSS base score

6.0/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects. Attackers can exploit this by crafting malicious cross-origin redirect chains to intercept sensitive authorization credentials intended for legitimate requests.

Key dates

02Disclosure timeline

April 23, 2026 CVE published
April 24, 2026 Record updated