OpenClaw versions before 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing attackers on trusted networks to bypass required tokens or passwords and access protected routes without credentials. This authorization bypass, classified as CWE-290, can expose confidential data, allow tampering, or disrupt service within the gateway.

The vulnerable product is OpenClaw, a Node.js application. All releases older than version 2026.2.21 are affected. The flaw manifests in the HTTP gateway route handling, impacting any service that relies on Tailscale authentication for access control.

With a CVSS score of 8.2, the vulnerability is considered high severity. No EPSS score is available and there is no record of public exploitation yet. The likely attack vector is a network-based approach from within a trusted network that can provide the tokenless Tailscale header. Successful exploitation would grant attackers unrestricted access to gateway routes, potentially leading to data theft or other malicious actions.