CVE-2026-32970 LOW

CVE-2026-32970: OpenClaw < 2026.3.11 - Credential Fallback Logic Bypass via Unavailable Local Auth SecretRefs

Vendor Openclaw
Product OpenClaw
Weakness CWE-636
Published March 31, 2026
Last update March 31, 2026
View on NVD All CVEs

CVSS base score

2.5/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to cause CLI and helper paths to select incorrect credential sources, potentially bypassing intended local authentication boundaries.

Key dates

02Disclosure timeline

March 31, 2026 CVE published
March 31, 2026 Record updated