PT-2026-29230 · Openclaw · Openclaw

Tdjackey · Published 2026-03-13 · Updated 2026-03-31 · CVE-2026-32970

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11

Description The software contains a credential fallback issue. When local gateway authentication tokens (gateway.auth.token) and passwords (gateway.auth.password) are unavailable, the system incorrectly falls back to remote credentials even when operating in local mode. This can occur due to misconfigured local authentication references, potentially allowing attackers to bypass local authentication restrictions and access the system using unintended credentials. The issue affects CLI and helper paths, causing them to select incorrect credential sources.

Recommendations Update to version 2026.3.11 or later.

Fix

Weakness Enumeration

CWE-636

Related Identifiers

CVE-2026-32970

GHSA-QVR7-G57C-MRC7

GHSA-VM29-7MQ3-9JRG

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-qvr7-g57c-mrc7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vm29-7mq3-9jrg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qvr7-g57c-mrc7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32970 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.11 · Note
• https://vulncheck.com/advisories/openclaw-credential-fallback-logic-bypass-via-unavailable-local-auth-secretrefs · Note
• https://twitter.com/CVEnew/status/2039004487231160819 · Twitter Post