Loading vulnerability…
Authentication Bypass in OpenClaw HTTP Gateway Routes via Tokenless Tailscale Header Authentication
CVE-2026-32045 is an authentication bypass vulnerability in OpenClaw affecting versions prior to 2026.2.21. The flaw is caused by incorrect application of tokenless Tailscale header authentication to HTTP gateway routes. As a result, affected HTTP gateway routes may accept requests under the weaker tokenless Tailscale trust model instead of enforcing the intended token and password checks. This allows unauthorized access to HTTP gateway routes without valid authentication credentials when requests originate from a trusted network context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated attacker on a trusted network to bypass token and password requirements and access protected HTTP gateway routes. Based on the provided scoring and description, the primary impact is unauthorized access to information exposed through those routes, with high confidentiality impact. No specific integrity or availability impact is indicated in the provided content.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to affected OpenClaw HTTP gateway routes to only strictly necessary and fully trusted network paths, especially where Tailscale-derived headers may be accepted. Reduce exposure of the HTTP gateway, enforce network-layer access controls, and monitor for requests reaching gateway routes without expected token or password authentication. Where feasible, disable or isolate the affected routes until the fixed version can be deployed.
Patch, then assume compromise.
Upgrade OpenClaw to version 2026.2.21 or later, which addresses the incorrect application of tokenless Tailscale header authentication to HTTP gateway routes. Review the associated OpenClaw fix referenced by commit 356d61aacfa5b0f1d5830716ec59d70682a3e7b8 and validate that HTTP gateway routes enforce the intended token and password authentication logic after upgrading.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.