CVE-2026-32034: OpenClaw Control UI insecure auth bypass over plaintext HTTP

CVE-2026-32034 · Severity: low · CVSS 3.1 · Published 2026-03-03

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw's Control UI is a web interface for managing and operating the gateway. When explicitly configured to allow insecure authentication and exposed over unencrypted HTTP, the Control UI bypasses critical security checks including device identity verification and pairing requirements. An attacker who intercepts credentials in transit or obtains them through other means can gain full administrative access to the gateway, enabling complete system compromise and control of the underlying platform.

Technical details

This vulnerability is an authentication bypass with cleartext transmission issues (CWE-285, CWE-319). When gateway.controlUi.allowInsecureAuth is explicitly enabled, the allowControlUiBypass flag suppresses two security checks in the WebSocket handshake handler: (1) HTTPS/localhost enforcement that normally blocks non-secure Control UI connections, and (2) device pairing requirements that gate access for new devices. This allows any client presenting a valid shared secret (token or password) to obtain full operator-level scopes over unencrypted HTTP without device identity registration or verification. Tokens are transmitted in plaintext. The vulnerability requires deliberate insecure configuration and credential exposure (plaintext transit or prior token leak). The fix, merged in commit 40a292619e1f2be3a3b1db663d7494c9c2dc0abf on 2026-02-20, corrects the allowControlUiBypass calculation to exclude the allowInsecureAuth flag, ensuring security checks are enforced even when insecure auth is configured.

CVE-2026-32034: OpenClaw Control UI insecure auth bypass over plaintext HTTP

Executive brief

Technical details

Affected products

Timeline

References

Related threats