CVE-2026-32008: OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files

March 3, 2026 (updated March 19, 2026)

assertBrowserNavigationAllowed() validated only http:/https: network targets but implicitly allowed other schemes. An authenticated gateway user could navigate browser sessions to file:// URLs and read local files via browser snapshot/extraction flows.

References

github.com/advisories/GHSA-45cg-2683-gfmq
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/220bd95eff6838234e8b4b711f86d4565e16e401
github.com/openclaw/openclaw/security/advisories/GHSA-45cg-2683-gfmq
nvd.nist.gov/vuln/detail/CVE-2026-32008

Code Behaviors & Features

Detect and mitigate CVE-2026-32008 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →