OpenClaw Unauthenticated Access to Browser Control Routes via Authentication Bootstrap Error

A vulnerability in OpenClaw versions prior to 2026.3.1 allows browser-control routes to remain accessible without authentication. This issue arises because the application fails to properly manage authentication bootstrap errors during startup. As a result, local processes or loopback-reachable SSRF paths can exploit this flaw to access browser-control routes, including actions that can evaluate code, without valid credentials.

Impact

Exploitation of this vulnerability allows unauthorized access to browser-control routes, including evaluate-capable actions.

Remediation

Users can upgrade to OpenClaw version 2026.3.1 or later to address this vulnerability.