CVE-2026-41345: OpenClaw < 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media Download

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-23 · updated 2026-06-17
Weakness: CWE-522

Description

OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects. Attackers can exploit this by crafting malicious cross-origin redirect chains to intercept sensitive authorization credentials intended for legitimate requests.

Affected products

OpenClaw: before 2026.3.31 — fixed in 2026.3.31

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.31. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/e704323ff388ed21f6963f9b8e0b1b8dfaaabc5f
https://github.com/openclaw/openclaw/security/advisories/GHSA-68v4-hmwv-f43h
https://www.vulncheck.com/advisories/openclaw-authorization-header-leak-via-cross-origin-redirect-in-media-download

Get alerted when CVE-2026-41345 or the next vulnerability affects your stack