CVE-2026-32970: OpenClaw < 2026.3.11 - Credential Fallback Logic Bypass via Unavailable Local Auth SecretRefs
OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to cause CLI and helper paths to select incorrect credential sources, potentially bypassing intended local authentication boundaries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.3.11 - Compensating control
Until upgraded to 2026.3.11, ensure the local gateway.auth.token and gateway.auth.password SecretRefs are available/set so local-mode does not fall back to remote credentials when those SecretRefs are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32970?
CVE-2026-32970 is classified as a high-severity vulnerability due to its potential impact on credential security.
How do I fix CVE-2026-32970?
To fix CVE-2026-32970, you should update OpenClaw to version 2026.3.11 or later.
What specifically does CVE-2026-32970 exploit?
CVE-2026-32970 exploits a credential fallback logic that allows fallback to remote credentials when local authentication secrets are unavailable.
What systems are affected by CVE-2026-32970?
CVE-2026-32970 affects all versions of OpenClaw prior to 2026.3.11.
What are the potential consequences of CVE-2026-32970?
The consequences of CVE-2026-32970 include unauthorized access to systems due to the improper handling of authentication tokens and passwords.