{"action":"Upgrade openclaw to 2026.2.21 or later.","affected":[{"fixed":"2026.2.21","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-32045"],"ecosystem":"npm","epss":0.00408,"exploited":false,"fixed_versions":["2026.2.21"],"ghsa_id":"GHSA-hff7-ccv5-52f8","id":"tcs_01M5KFTWKS11RPXC9FE9ZD267B","modified_at":"2026-03-24T18:26:22.567299Z","published_at":"2026-03-03T18:43:04Z","references":["https://osv.dev/vulnerability/GHSA-hff7-ccv5-52f8","https://github.com/openclaw/openclaw/security/advisories/GHSA-hff7-ccv5-52f8","https://nvd.nist.gov/vuln/detail/CVE-2026-32045","https://github.com/openclaw/openclaw/commit/356d61aacfa5b0f1d5830716ec59d70682a3e7b8","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-authentication-bypass-in-http-gateway-routes-via-tokenless-tailscale-auth"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-hff7-ccv5-52f8","url":"https://osv.dev/vulnerability/GHSA-hff7-ccv5-52f8"},{"source":"nvd","source_id":"CVE-2026-32045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32045"}],"summary":"OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes"}