CVE-2026-32970Low· 2.5▾ SunlitOpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode. Attackers…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to cause CLI and helper paths to select incorrect credential sources, potentially bypassing intended local authentication boundaries.
openclaw < 2026.3.11Upgrade past the affected range:
openclaw 2026.3.11Connected by shared product, vendor, weakness, or advisory.
GHSA-gp79-m99v-gjmhMediumOpenClaw: Mattermost handlers could fall open when channel type was missing
GHSA-hc4w-hm59-9w88Low· 5.4Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment
CVE-2026-53852Low· 5.4OpenClaw: Empty-scope device re-pairing could confuse caller scope containment
CVE-2026-94094Medium· 4.3A flaw has been found in OpenClaw up to 2026.9.5
CVE-2026-32896Medium· 4.8The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations
CVE-2026-28465Medium· 5.9OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers