PT-2026-26410 · Openclaw · Openclaw

Anthony Disanti + 1 · Published 2026-03-03 · Updated 2026-03-20 · CVE-2026-32029

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.21

Description OpenClaw improperly parses the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoof client IP addresses. In proxy chains that append or preserve header values, attackers can inject malicious header content to influence security decisions, including authentication rate-limiting and IP-based access controls. The issue affects deployments behind trusted proxies with non-recommended forwarding behavior. The vulnerable component uses the left-most X-Forwarded-For value when processing requests from trusted proxies. This can lead to client-IP spoofing in security-sensitive areas such as authentication rate limits and identity classification. The API endpoint is not explicitly mentioned. The vulnerable parameter is the X-Forwarded-For header.

Recommendations Versions prior to 2026.2.21 should be updated to version 2026.2.21 or later.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

CWE-807

Related Identifiers

CVE-2026-32029

GHSA-2RGF-HM63-5QPH

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-2rgf-hm63-5qph · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/07039dc089e51589a213ec0d16f8d6f2cd871fa1 · Patch
• https://github.com/openclaw/openclaw/commit/8877bfd11ec7760b115b2d0d7500a45da2749747 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32029 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32029 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2rgf-hm63-5qph · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-client-ip-spoofing-via-x-forwarded-for-header-parsing · Note
• https://twitter.com/CVEnew/status/2034891587788959811 · Twitter Post