Description
OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intended for the original destination.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenClaw | OpenClaw | < 2026.3.7 | 2026.3.7 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
Rickidevs/CVE-2026-32913 ★ 0 · Mar 13, 2026
I Found a Zero-Day Vulnerability in OpenClaw — Here’s How It Went
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | openclaw | < 2026.3.7 | 2026.3.7 | GHSA-6mgf-v5j7-45cr |
Advisories 1
- WID-SEC-2026-0639 OpenClaw: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 23, 2026
References
- GitHub Security Advisory (GHSA-6mgf-v5j7-45cr) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory third-party-advisory