CVE-2026-32029
mediumpriority · track · 0OT risk · elevatedEPSS 0.002 · 9 %ileDEEUUSEPSS · scored 2026-10-27
OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoof client IP addresses. In proxy chains that append or preserve header values, attackers can inject malicious header content to influence security decisions including authentication rate-limiting and IP-based access controls.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.7–6.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0472OpenClaw: Mehrere SchwachstellenDeutsch2026-02-22csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.
- GHSA-2rgf-hm63-5qphOpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions2026-03-03ghsa · osvUS
### Summary OpenClaw used left-most `X-Forwarded-For` values when requests came from configured trusted proxies. In proxy chains that append/preserve header values, this could let attacker-controlled header content influence security decisions tied to client IP. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `<= 2026.2.19-2` - Patched: `2026.2.21` (planned next release) ### Impact Possible client-IP spoofing in security-sensitive paths (for example auth rate-limit identity and local/private classification) for deployments behind trusted proxies with non-recommended forwarding behavior. ### Scope Note OpenClaw docs recommend reverse proxies overwrite (not append/preserve) inbound forwarding headers. This condition reduces severity. ### Fix Commit(s) - `07039dc089e51589a213ec0d16f8d6f2cd871fa1` - `8877bfd11ec7760b115b2d0d7500a45da2749747` ### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`). After npm release is out, publish this advisory. OpenClaw thanks @AnthonyDiSanti for reporting.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclaw/commit/07039dc089e51589a213ec0d16f8d6f2cd871fa1cnnvd
- https://github.com/openclaw/openclaw/commit/8877bfd11ec7760b115b2d0d7500a45da2749747cnnvd
- https://github.com/openclaw/openclaw/releasesPatchcnnvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2rgf-hm63-5qphcnnvd
- https://www.vulncheck.com/advisories/openclaw-client-ip-spoofing-via-x-forwarded-for-header-parsingcnnvd
- https://github.com/openclaw/openclaw/commit/07039dc089e51589a213ec0d16f8d6f2cd871fa1enisa_euvd
- https://github.com/openclaw/openclaw/commit/8877bfd11ec7760b115b2d0d7500a45da2749747enisa_euvd
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2rgf-hm63-5qphenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan