OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access

高 8.1CVE-2026-32034 · GHSA-3cvx-236h-m9fj · 19/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-32034 は openclaw (openclaw), openclaw に影響する深刻度「高」 (CVSS 8.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.40%（全脆弱性の 33.9% より高い）。
対処：2026.2.21 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
openclaw openclaw	`< 2026.2.21`	`2026.2.21`
openclaw npm	`< 2026.2.21`	`2026.2.21`

概要

Description

In affected releases, when an operator explicitly enabled gateway.controlUi.allowInsecureAuth: true and exposed the gateway over plaintext HTTP, Control UI authentication could permit privileged operator access without the intended device identity + pairing guarantees.

This required an insecure deployment choice and credential exposure risk (for example, plaintext transit or prior token leak). It was fixed on main in commit 40a292619e1f2be3a3b1db663d7494c9c2dc0abf (PR #20684).

Affected Packages / Versions

Package: openclaw (npm)
Affected published versions: <= 2026.2.19-2
Planned patched version: 2026.2.21

Impact

In these explicitly insecure deployments, an attacker with leaked/intercepted credentials could obtain high-privilege Control UI access.

Fix Commit(s)

40a292619e1f2be3a3b1db663d7494c9c2dc0abf (merged 2026-02-20)

OpenClaw thanks @Vasco0x4 for reporting.

NVD の説明

OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is exposed over plaintext HTTP, allowing attackers to bypass device identity and pairing verification. An attacker with leaked or intercepted credentials can obtain high-privilege Control UI access by exploiting the lack of secure authentication enforcement over unencrypted HTTP connections.