CVE-2026-32045 is an authentication bypass in OpenClaw, scored 5.9 by NVD. When tokenless Tailscale auth was on, it could also apply to HTTP gateway routes, which skipped the token and password. Upgrade OpenClaw to 2026.2.21 or later. Checks and steps follow below.
What's affected
OpenClaw 2026.2.19-2 and earlier. The patched version is 2026.2.21.
The advisory says this matters in trusted network deployments where Tailscale header auth is enabled. It says the recommended setup, a loopback only gateway with Tailscale serve or funnel for remote access, is not affected.
How to check if you're exposed
OpenClaw is distributed on npm, so read the installed version.
npm ls openclaw
npm ls -g openclaw
OpenClaw release numbers are date based, so compare the version against the fixed release named above. If you run it in a container, check the image you deploy and rebuild it after updating.
What to do now
- Upgrade OpenClaw to 2026.2.21 or later.
- Check whether tokenless Tailscale header auth is enabled in your gateway settings and turn it off if you do not need it.
- Keep the gateway on loopback, as the project recommends.
- Treat anyone on the trusted network as able to reach HTTP routes until you are patched.
Why it matters
The record lists CWE-290, authentication bypass by spoofing. Header based auth is meant for the Control UI websocket login on trusted hosts. In affected versions the same path also served HTTP gateway authentication, so deployments that expected a token or password on HTTP routes fell back to header trust.
The fix adds an explicit setting for where header auth is allowed, off by default, and keeps HTTP routes on token or password checks.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Am I affected if I follow the recommended setup?
The advisory says the recommended setup is not affected.
What does the fix change?
Header auth is limited to the Control UI websocket login, and HTTP routes use token or password only.
Sources
Last reviewed: 19 October 2026.
