CVE-2026-32045: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes
(updated )
When tokenless Tailscale auth is enabled, OpenClaw should only allow forwarded-header auth for Control UI websocket authentication on trusted hosts. In affected versions, that tokenless path could also be used by HTTP gateway auth call sites, which could bypass token/password requirements for HTTP routes in trusted-network deployments.
References
- github.com/advisories/GHSA-hff7-ccv5-52f8
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/356d61aacfa5b0f1d5830716ec59d70682a3e7b8
- github.com/openclaw/openclaw/security/advisories/GHSA-hff7-ccv5-52f8
- nvd.nist.gov/vuln/detail/CVE-2026-32045
- www.vulncheck.com/advisories/openclaw-authentication-bypass-in-http-gateway-routes-via-tokenless-tailscale-auth
Code Behaviors & Features
Detect and mitigate CVE-2026-32045 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →