PT-2026-29230 · Openclaw · Openclaw

Tdjackey · CVE-2026-32970 · Publicado 2026-03-13 · Atualizado 2026-07-25

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description The software contains a credential fallback issue. When local gateway authentication tokens (gateway.auth.token) and passwords (gateway.auth.password) are unavailable, the system incorrectly falls back to remote credentials even when operating in local mode. This can occur due to misconfigured local authentication references, potentially allowing attackers to bypass local authentication restrictions and access the system using unintended credentials. The issue affects CLI and helper paths, causing them to select incorrect credential sources.

Recommendations Update to version 2026.3.11 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-636

Identificadores relacionados

CVE-2026-32970

GHSA-QVR7-G57C-MRC7

GHSA-VM29-7MQ3-9JRG

Produtos afetados

Openclaw

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32970.json · Exploit
• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qvr7-g57c-mrc7 · Aviso do Fabricante
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.11 · Nota
• https://twitter.com/CVEnew/status/2039004487231160819 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32970 · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-credential-fallback-logic-bypass-via-unavailable-local-auth-secretrefs · Nota
• https://t.me/cveNotify/222912 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-qvr7-g57c-mrc7 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vm29-7mq3-9jrg · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32970 · Nota de Segurança