← Database

CVE-2026-32913

CRITICAL CVSS: 9.3 Published: 2026-03-23 Modified: 2026-06-17

Description

OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intended for the original destination.

Affected Platforms

Openclaw Openclaw

Weakness Type

CWE-522

References