CVE-2026-32970
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
OpenClaw before 2026.3.11 has a credential fallback vulnerability where unavailable local tokens are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to bypass intended authentication boundaries.
Risk Assessment
Risk of bypassing local authentication and using remote credentials, potentially leading to unauthorized access.
Recommendation
Update OpenClaw to version 2026.3.11 or later. Review local authentication reference configuration.
Original NVD description (English source)
OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to cause CLI and helper paths to select incorrect credential sources, potentially bypassing intended local authentication boundaries.