CVE-2026-32045: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32045 is an authentication bypass vulnerability in OpenClaw (npm package) affecting all versions up to and including 2026.2.19-2. When tokenless Tailscale header authentication is enabled, the affected versions incorrectly apply this authentication path to HTTP gateway routes in addition to the intended Control UI WebSocket authentication, allowing attackers on trusted networks to bypass token and password requirements. The vulnerability was disclosed on March 21, 2026, with a patch planned for version 2026.2.21. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing). When gateway.auth.allowTailscale is set to true (the default when tailscale.mode = "serve"), OpenClaw is intended to accept Tailscale Serve identity headers (tailscale-user-login) only for Control UI WebSocket authentication. However, in affected versions, the tokenless Tailscale header auth path lacked an explicit allowTailscaleHeaderAuth gate, causing HTTP gateway API call sites (e.g., /v1/*, /tools/invoke, /api/channels/*) to also accept these headers without requiring a token or password. The fix introduced an explicit allowTailscaleHeaderAuth flag (defaulting to false) in gateway auth logic, restricting tokenless Tailscale header auth exclusively to WebSocket authentication (GitHub Advisory, Patch Commit).

Successful exploitation allows attackers positioned on a trusted network (e.g., a Tailscale tailnet) to access HTTP gateway API routes — including tool invocation and channel management endpoints — without supplying valid authentication tokens or passwords. This results in high confidentiality impact (unauthorized access to sensitive data and configurations) and high integrity impact (ability to modify resources or invoke tools without authorization). Availability is not directly impacted. Deployments that rely on token/password authentication for HTTP gateway routes while also enabling Tailscale Serve are most at risk (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.059%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to be on a trusted network (e.g., within the Tailscale tailnet) and the target deployment to have gateway.auth.allowTailscale: true configured, which limits the attack surface to specific deployment configurations (GitHub Advisory).

1. Reconnaissance: Identify OpenClaw gateway instances running versions ≤ 2026.2.19-2 with gateway.auth.allowTailscale: true and tailscale.mode: "serve" configured, accessible from within a Tailscale tailnet.
2. Network positioning: Gain access to the trusted Tailscale network (tailnet) from which the OpenClaw gateway is reachable — this may involve compromising a tailnet node or being an authorized tailnet member.
3. Craft spoofed request: Construct an HTTP request to an HTTP gateway API endpoint (e.g., /v1/*, /tools/invoke, or /api/channels/*) that includes Tailscale Serve forwarded headers: x-forwarded-for, x-forwarded-proto, x-forwarded-host, and tailscale-user-login, mimicking a legitimate Tailscale Serve-proxied request arriving from loopback.
4. Bypass authentication: Submit the crafted request to the gateway. In affected versions, the tokenless Tailscale header auth path is evaluated for HTTP routes, causing the gateway to accept the request without a valid token or password.
5. Access protected resources: With authentication bypassed, invoke HTTP API endpoints to read sensitive data, invoke tools, or modify channel configurations without authorization (GitHub Advisory, Patch Commit).

• Network: Unexpected HTTP requests to gateway API endpoints (/v1/*, /tools/invoke, /api/channels/*) originating from Tailscale tailnet IP ranges (e.g., 100.64.0.0/10) without accompanying authentication tokens or passwords.
• Logs: Gateway access logs showing successful 200 responses to HTTP API routes authenticated via method: tailscale rather than method: token or method: password; log entries with tailscale-user-login header present on non-WebSocket HTTP requests.
• Process/Behavior: Unexpected tool invocations or channel modifications in OpenClaw audit logs not initiated by known authorized users; unusual API activity patterns on HTTP gateway routes during off-hours.

Upgrade OpenClaw to version 2026.2.21 or later, which introduces the allowTailscaleHeaderAuth gate (defaulting to false) to restrict tokenless Tailscale header auth exclusively to Control UI WebSocket authentication (Patch Commit). As an immediate workaround prior to patching, set gateway.auth.allowTailscale: false in your configuration to disable tokenless Tailscale header auth entirely and require explicit token/password credentials for all routes. Additionally, restrict network access to HTTP gateway routes to only authorized users and systems, and review authentication logs for any suspicious unauthenticated access to gateway API endpoints (GitHub Advisory).

The vulnerability was reported by researcher zpbrent and acknowledged by the OpenClaw maintainer (steipete) in the GitHub Security Advisory. The advisory was rated as "Moderate" severity by the project maintainers, noting that the recommended deployment setup (gateway loopback-only with Tailscale Serve/Funnel for remote access) limits exposure. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and VulnCheck advisory (GitHub Advisory).