CVE-2026-32913 is a high severity credential leak in OpenClaw, scored CVSS 9.3 by NVD. Its request guard forwarded custom authorization headers such as X-Api-Key across cross-origin redirects. OpenClaw 2026.3.7 fixes it. Upgrade, and rotate any keys that may have been sent to a redirecting service.
What's affected
The GitHub advisory lists the npm package openclaw at versions up to 2026.3.2 and names 2026.3.7 as patched. The NVD record words it as before 2026.3.7. The advisory notes that 2026.3.7 was published on 8 March 2026.
The function is fetchWithSsrFGuard. The advisory says it removed only a short list of sensitive headers (Authorization, Proxy-Authorization, Cookie and Cookie2) when following a redirect, so custom headers like X-Api-Key or Private-Token went along. The advisory scores it High at 7.5; NVD scores it 9.3.
How to check if you're exposed
Check the installed version:
npm ls openclaw
Then list which outbound requests your OpenClaw code makes with custom authentication headers, and which of those targets can redirect. Any service that can send a redirect to another origin could receive the header.
Look in your configuration for API keys passed through headers other than Authorization.
What to do now
- Upgrade OpenClaw to 2026.3.7 or later.
- Rotate any API key or token that you sent in a custom header to a service that may redirect.
- Prefer passing credentials in the standard Authorization header, which the guard already stripped.
- Review which third party endpoints your integrations call and remove ones you do not trust.
- Check outbound request logs for redirects to unfamiliar origins.
Why it matters
The class is CWE-522, insufficiently protected credentials. The advisory says the fix changes the logic from a denylist to an allowlist: only harmless headers such as content negotiation and cache validators survive a change of origin.
A denylist fails whenever someone invents a new header name for a secret. An allowlist fails closed. It is a good pattern for any code that follows redirects on a user's behalf. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which headers are safe to forward on redirects?
The advisory says only benign ones, such as content negotiation and cache validators, should survive a cross-origin redirect.
Sources
Last reviewed: 19 October 2026.
