---
id: CVE-2026-32970
title: >-
  OpenClaw before 2026.3.11 contains a credential fallback vulnerability where
  unavailable local gateway.auth.token and gateway.auth.password SecretRefs are
  treated as unset, allowing fallback to remote credentials in local mode
summary: >-
  OpenClaw before 2026.3.11 contains a credential fallback vulnerability where
  unavailable local gateway.auth.token and gateway.auth.password SecretRefs are
  treated as unset, allowing fallback to remote credentials in local mode.
  Attackers…
severity: low
cvss: 2.5
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-636
vendor: openclaw
product: openclaw
affected:
  - openclaw < 2026.3.11
patched:
  - openclaw 2026.3.11
published: '2026-03-31'
updated: '2026-07-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32970'
references:
  - url: >-
      https://github.com/openclaw/openclaw/security/advisories/GHSA-qvr7-g57c-mrc7
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openclaw-credential-fallback-logic-bypass-via-unavailable-local-auth-secretrefs
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00149
epssPercentile: 0.03431
ingestedAt: '2026-07-25T10:53:53.395Z'
---

## Overview

OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to cause CLI and helper paths to select incorrect credential sources, potentially bypassing intended local authentication boundaries.

## Affected

- `openclaw < 2026.3.11`

## Remediation

Upgrade past the affected range:

- `openclaw 2026.3.11`