CVE-2026-32913 — OpenClaw before 2026.3.7 contains an improper header validation vulnerability in…¶

Key facts

CVE-2026-32913 is a Critical (9.3) vulnerability: OpenClaw before 2026.3.7 contains an improper header validation vulnerability in…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-32913
Severity	Critical (9.3)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-32913/

Details¶

CVE-2026-32913 is a Critical (9.3) vulnerability: OpenClaw before 2026.3.7 contains an improper header validation vulnerability in…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intended for the original destination.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-32913
Type	SSRF
CVSS Score	9.3

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-32913/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-32913

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/commit/46715371b0612a6f9114dffd1466941ac476cef5
https://github.com/openclaw/openclaw/security/advisories/GHSA-6mgf-v5j7-45cr
https://vulncheck.com/advisories/openclaw-mar-custom-authorization-header-leakage-via-cross-origin-redirects

Generated by PoC Generator on 2026-04-10T15:44:17.621026481

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-32913, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-32913 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-32913 OpenClaw SSRF header forwarding attempt"; flow:established,to_server; content:"GET"; http_method; content:"fetchWithSsrFGuard"; http_uri; content:"X-Api-Key"; http_header; content:"Location:"; http_header; pcre:"/Location:\s*https?:\/\/[^\/]+/i"; sid:1000000; rev:1; classtype:web-application-attack; priority:2;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-32913 OpenClaw SSRF Private-Token header exposure"; flow:established,to_server; content:"POST"; http_method; content:"fetchWithSsrFGuard"; http_uri; content:"Private-Token"; http_header; content:"Location:"; http_header; pcre:"/Location:\s*https?:\/\/(?!.*\b(?:localhost|127\.0\.0\.1|10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[01])\.))/i"; sid:1000001; rev:1; classtype:web-application-attack; priority:2;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-32913 OpenClaw SSRF cross-origin redirect response"; flow:established,to_client; content:"302"; http_stat_code; content:"Location:"; http_header; content:"X-Api-Key"; http_header; pcre:"/Location:\s*https?:\/\/[^\/]+/i"; sid:1000002; rev:1; classtype:web-application-attack; priority:2;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-32913 OpenClaw SSRF authorization header forwarding"; flow:established,to_server; content:"fetchWithSsrFGuard"; http_uri; content:"Authorization:"; http_header; content:"Location:"; http_header; pcre:"/Location:\s*https?:\/\/[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,}/i"; reference:cve,CVE-2026-32913; sid:1000003; rev:1; classtype:web-application-attack; priority:2;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-32913 OpenClaw SSRF multiple sensitive headers in redirect"; flow:established,to_server; content:"fetchWithSsrFGuard"; http_uri; content:"|0d 0a|X-Api-Key"; http_header; content:"|0d 0a|Private-Token"; http_header; content:"30"; http_stat_code; depth:3; reference:cve,CVE-2026-32913; sid:1000004; rev:1; classtype:web-application-attack; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_32913_OpenClaw_SSRF_Header_Validation {
    meta:
        author = "Security Engineer"
        description = "Detects exploitation of CVE-2026-32913 - OpenClaw SSRF vulnerability with improper header validation"
        cve = "CVE-2026-32913"
        severity = "high"
        category = "exploit"
        date = "2024-12-19"

    strings:
        $func_name = "fetchWithSsrfGuard" ascii nocase
        $func_name2 = "fetchWithSsrFGuard" ascii nocase

        $header1 = "X-Api-Key" ascii nocase
        $header2 = "Private-Token" ascii nocase
        $header3 = "Authorization:" ascii nocase
        $header4 = "Bearer " ascii nocase

        $redirect_pattern1 = /Location:\s*https?:\/\/[^\/\s]+/ ascii nocase
        $redirect_pattern2 = /302\s+Found/ ascii nocase
        $redirect_pattern3 = /301\s+Moved/ ascii nocase

        $openclaw_version = /OpenClaw[\s\/]+(1\.|2\.0\.|2026\.[0-2]\.|2026\.3\.[0-6])/ ascii nocase

        $exploit_string1 = "cross-origin" ascii nocase
        $exploit_string2 = "redirect" ascii nocase
        $exploit_string3 = "intercept" ascii nocase

        $hex_header = { 58 2D 41 70 69 2D 4B 65 79 } // X-Api-Key
        $hex_private = { 50 72 69 76 61 74 65 2D 54 6F 6B 65 6E } // Private-Token

    condition:
        (
            ($func_name or $func_name2) and 
            any of ($header*) and 
            any of ($redirect_pattern*)
        ) or
        (
            $openclaw_version and 
            any of ($header*) and 
            2 of ($exploit_string*)
        ) or
        (
            any of ($hex_*) and 
            any of ($redirect_pattern*)
        )
}

rule CVE_2026_32913_OpenClaw_SSRF_Memory_Pattern {
    meta:
        author = "Security Engineer"
        description = "Memory-based detection for CVE-2026-32913 OpenClaw SSRF exploitation"
        cve = "CVE-2026-32913"
        severity = "high"
        category = "memory_exploit"

    strings:
        $mem_pattern1 = { 48 54 54 50 2F 31 2E 31 20 33 30 [1-2] 20 } // HTTP/1.1 30x
        $mem_pattern2 = { 4C 6F 63 61 74 69 6F 6E 3A 20 68 74 74 70 } // Location: http
        $mem_pattern3 = { 41 75 74 68 6F 72 69 7A 61 74 69 6F 6E 3A } // Authorization:

        $api_key_header = { 58 2D 41 70 69 2D 4B 65 79 3A 20 [10-100] } // X-Api-Key: ...
        $private_token = { 50 72 69 76 61 74 65 2D 54 6F 6B 65 6E 3A 20 [10-100] } // Private-Token: ...

        $cors_origin = { 41 63 63 65 73 73 2D 43 6F 6E 74 72 6F 6C 2D 41 6C 6C 6F 77 2D 4F 72 69 67 69 6E } // Access-Control-Allow-Origin

    condition:
        2 of ($mem_pattern*) and 
        any of ($api_key_header, $private_token, $cors_origin)
}

rule CVE_2026_32913_OpenClaw_SSRF_Config_File {
    meta:
        author = "Security Engineer"
        description = "Configuration file patterns for CVE-2026-32913 OpenClaw SSRF"
        cve = "CVE-2026-32913"
        severity = "medium"
        category = "config"

    strings:
        $config1 = "ssrf_guard" ascii nocase
        $config2 = "header_validation" ascii nocase
        $config3 = "cross_origin_redirect" ascii nocase
        $config4 = "fetchWithSsrfGuard" ascii nocase

        $vulnerable_version = /version[\"\':\s]*[\"\'](2026\.[0-2]\.|2026\.3\.[0-6])[\"\']/ ascii nocase

        $json_pattern1 = /"allowCrossOriginRedirects"\s*:\s*true/
        $json_pattern2 = /"validateHeaders"\s*:\s*false/
        $json_pattern3 = /"ssrfProtection"\s*:\s*false/

    condition:
        (
            any of ($config*) and $vulnerable_version
        ) or
        any of ($json_pattern*)
}

:material-file-download: prevention/yara.yar

# Block requests with suspicious authorization headers in SSRF-prone endpoints
location ~* /api/fetch|/fetch|/proxy|/webhook|/callback {
    # Block requests with multiple authorization headers
    if ($http_authorization ~ "^(.+,.*|.*,.+)$") {
        return 403;
    }

    # Block requests with custom authorization headers that could be intercepted
    if ($http_x_api_key != "") {
        set $ssrf_risk "${ssrf_risk}1";
    }
    if ($http_private_token != "") {
        set $ssrf_risk "${ssrf_risk}2";
    }
    if ($http_x_auth_token != "") {
        set $ssrf_risk "${ssrf_risk}3";
    }

    # Block if multiple sensitive headers are present
    if ($ssrf_risk ~ "^.{2,}$") {
        return 403;
    }

    # Block requests with suspicious redirect parameters
    if ($args ~* "(url|redirect|callback|endpoint|target)=https?://(?!your-domain\.com)") {
        return 403;
    }

    # Block requests attempting to access internal networks
    if ($args ~* "(url|redirect|callback|endpoint|target)=.*(?:localhost|127\.0\.0\.1|192\.168\.|10\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|169\.254\.|0\.0\.0\.0|::1|0:0:0:0:0:0:0:1)") {
        return 403;
    }

    # Strip potentially dangerous headers from proxied requests
    proxy_set_header X-Api-Key "";
    proxy_set_header Private-Token "";
    proxy_set_header X-Auth-Token "";
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;

    # Security headers
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    proxy_pass $backend;
}

# Block direct access to fetchWithSsrFGuard endpoints
location ~* /fetchWithSsrFGuard {
    # Block all external requests to this vulnerable endpoint
    if ($remote_addr !~ "^(127\.0\.0\.1|::1|192\.168\.|10\.|172\.(?:1[6-9]|2[0-9]|3[01])\.)") {
        return 403;
    }

    # Remove authorization headers completely for this endpoint
    proxy_set_header Authorization "";
    proxy_set_header X-Api-Key "";
    proxy_set_header Private-Token "";

    proxy_pass $backend;
}

# General SSRF protection for all locations
location / {
    # Block requests with file:// or other dangerous protocols in parameters
    if ($args ~* "(url|redirect|callback|endpoint|target)=(?:file|ftp|gopher|dict|ldap|tftp|jar)://") {
        return 403;
    }

    # Block requests trying to access cloud metadata services
    if ($args ~* "(url|redirect|callback|endpoint|target)=.*(?:169\.254\.169\.254|metadata\.google\.internal|169\.254\.170\.2)") {
        return 403;
    }

    # Rate limiting for potential SSRF endpoints
    limit_req zone=ssrf_protection burst=10 nodelay;

    proxy_pass $backend;
}

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-32913 - SSRF via improper header validation in OpenClaw

# Rule 1000000: Block requests with suspicious authorization headers to potential redirect endpoints
SecRule REQUEST_HEADERS:Authorization "@detectXSS" \
    "id:1000000,\
    phase:1,\
    block,\
    msg:'CVE-2026-32913: Suspicious authorization header detected in potential SSRF attempt',\
    logdata:'Authorization header: %{REQUEST_HEADERS.Authorization}',\
    severity:HIGH,\
    tag:'attack-ssrf',\
    tag:'cve-2026-32913'"

# Rule 1000001: Detect and block requests with X-Api-Key headers to external domains
SecRule REQUEST_HEADERS:X-Api-Key "@rx ." \
    "id:1000001,\
    phase:1,\
    chain,\
    msg:'CVE-2026-32913: X-Api-Key header detected in potential cross-origin redirect',\
    logdata:'X-Api-Key header present with Host: %{REQUEST_HEADERS.Host}',\
    severity:HIGH,\
    tag:'attack-ssrf',\
    tag:'cve-2026-32913'"
SecRule REQUEST_HEADERS:Host "@rx ^(?!(?:localhost|127\.0\.0\.1|::1|[^.]+\.(?:local|internal)))" \
    "block"

# Rule 1000002: Block requests with Private-Token headers to external endpoints
SecRule REQUEST_HEADERS:Private-Token "@rx ." \
    "id:1000002,\
    phase:1,\
    chain,\
    msg:'CVE-2026-32913: Private-Token header detected in potential cross-origin redirect',\
    logdata:'Private-Token header present with Host: %{REQUEST_HEADERS.Host}',\
    severity:HIGH,\
    tag:'attack-ssrf',\
    tag:'cve-2026-32913'"
SecRule REQUEST_HEADERS:Host "@rx ^(?!(?:localhost|127\.0\.0\.1|::1|[^.]+\.(?:local|internal)))" \
    "block"

# Rule 1000003: Detect OpenClaw fetchWithSsrFGuard function exploitation attempts
SecRule REQUEST_URI "@contains fetchWithSsrFGuard" \
    "id:1000003,\
    phase:1,\
    block,\
    msg:'CVE-2026-32913: Direct access to fetchWithSsrFGuard function detected',\
    logdata:'URI: %{REQUEST_URI}',\
    severity:CRITICAL,\
    tag:'attack-ssrf',\
    tag:'cve-2026-32913'"

# Rule 1000004: Block requests with multiple custom authorization headers (potential header forwarding)
SecRule &REQUEST_HEADERS:Authorization "@ge 1" \
    "id:1000004,\
    phase:1,\
    chain,\
    msg:'CVE-2026-32913: Multiple authorization mechanisms detected',\
    severity:MEDIUM,\
    tag:'attack-ssrf',\
    tag:'cve-2026-32913'"
SecRule &REQUEST_HEADERS:X-Api-Key "@ge 1" \
    "chain"
SecRule REQUEST_HEADERS:Host "@rx ^(?!(?:localhost|127\.0\.0\.1|::1|[^.]+\.(?:local|internal)))" \
    "block,\
    logdata:'Multiple auth headers: Authorization=%{REQUEST_HEADERS.Authorization}, X-Api-Key=%{REQUEST_HEADERS.X-Api-Key}'"

# Rule 1000005: Block redirect responses that might leak headers (if ModSecurity can inspect responses)
SecRule RESPONSE_STATUS "@rx ^30[1-8]$" \
    "id:1000005,\
    phase:3,\
    chain,\
    msg:'CVE-2026-32913: Potential cross-origin redirect with sensitive headers',\
    severity:HIGH,\
    tag:'attack-ssrf',\
    tag:'cve-2026-32913'"
SecRule RESPONSE_HEADERS:Location "@rx ^https?://(?!(?:localhost|127\.0\.0\.1|::1|[^.]+\.(?:local|internal)))" \
    "block,\
    logdata:'Redirect location: %{RESPONSE_HEADERS.Location}'"

# Rule 1000006: Monitor for OpenClaw version patterns indicating vulnerable installations
SecRule REQUEST_HEADERS:User-Agent "@rx OpenClaw/(?:202[0-5]\.|2026\.[0-2]\.|2026\.3\.[0-6])" \
    "id:1000006,\
    phase:1,\
    pass,\
    msg:'CVE-2026-32913: Vulnerable OpenClaw version detected',\
    logdata:'User-Agent: %{REQUEST_HEADERS.User-Agent}',\
    severity:INFO,\
    tag:'vulnerability-scan',\
    tag:'cve-2026-32913'"

# Rule 1000007: Block requests attempting to exploit header injection for SSRF
SecRule REQUEST_HEADERS:/^X-/ "@rx (?:https?://|ftp://|file://)" \
    "id:1000007,\
    phase:1,\
    block,\
    msg:'CVE-2026-32913: URL injection detected in custom header',\
    logdata:'Malicious header: %{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\
    severity:HIGH,\
    tag:'attack-ssrf',\
    tag:'cve-2026-32913'"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-32913?¶

CVE-2026-32913 is a Critical (9.3) vulnerability: OpenClaw before 2026.3.7 contains an improper header validation vulnerability in…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-32913?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-32913?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.