CVE-2026-32029 | BDVDB-2026-321309 Detail
OpenClawOpenClaw
Description#
OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoof client IP addresses. In proxy chains that append or preserve header values, attackers can inject malicious header content to influence security decisions including authentication rate-limiting and IP-based access controls.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-345 Insufficient Verification of Data Authenticity
References#
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2rgf-hm63-5qph
- https://github.com/openclaw/openclaw/commit/07039dc089e51589a213ec0d16f8d6f2cd871fa1
- https://github.com/openclaw/openclaw/commit/8877bfd11ec7760b115b2d0d7500a45da2749747
- https://www.vulncheck.com/advisories/openclaw-client-ip-spoofing-via-x-forwarded-for-header-parsing
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.