CVE-2026-32913
OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects
Summary
OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects
Original description
The description as published by the source.
OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intended for the original destination.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com