Executive brief
OpenClaw is a browser automation and control library. When OpenClaw's browser control component attempted to bootstrap authentication automatically and that process failed, it would continue running without requiring authentication. This could allow a local attacker or a remote attacker through a server-side request forgery vulnerability to access sensitive browser control functions without authorization.
Technical details
The vulnerability is a missing authentication check (CWE-306) in OpenClaw's browser control startup sequence. When browser control started without explicit auth credentials, the system attempted automatic auth bootstrap. If this bootstrap threw an error in affected versions, startup would continue and expose browser-control routes—including code execution capabilities via evaluate actions—without authentication. Attack preconditions include local process access or loopback-reachable SSRF. The fix (version 2026.3.1 and later) changes startup behavior to fail closed: if bootstrap auth fails and no explicit credentials are configured, startup aborts entirely.
Affected products
- OpenClaw OpenClaw <= 2026.2.26
Timeline
- 2026-03-02: disclosed
- 2026-03-01: patched: Version 2026.3.1