Is there a patch available for CVE-2026-32970?

Yes, a patch is available for CVE-2026-32970. Update the affected software to the latest version immediately.

Openclaw CVE-2026-32970

Q: What is the CVSS score of CVE-2026-32970?

CVE-2026-32970 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17377 LOW

Not Failing Securely ('Failing Open') (CWE-636)

2026-03-31 VulnCheck

GHSA-vm29-7mq3-9jrg

Authentication Bypass Openclaw

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 07, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 11:45 euvd

EUVD-2026-17377

Analysis Generated

Mar 31, 2026 - 11:45 vuln.today

CVE Published

Mar 31, 2026 - 11:17 nvd

LOW 2.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.11.

DescriptionCVE.org

OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to cause CLI and helper paths to select incorrect credential sources, potentially bypassing intended local authentication boundaries.

AnalysisAI

OpenClaw before version 2026.3.11 allows local authenticated users to bypass local authentication boundaries through a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are incorrectly treated as unset, enabling fallback to remote credentials in local-only mode. The vulnerability requires local access and specific misconfiguration of auth references but can result in information disclosure if an attacker selects incorrect credential sources via CLI and helper paths. No public exploit code or active exploitation has been identified.

Technical ContextAI

OpenClaw is an authentication and credential management system that supports both local and remote credential sources. The vulnerability exists in the credential resolution logic (CWE-636: Weak Cryptography for Passwords) where SecretRef validation fails to properly distinguish between genuinely unavailable local authentication references and intentionally unset ones. When the gateway.auth.token or gateway.auth.password SecretRefs are misconfigured or point to unavailable resources, the authentication handler falls back to remote credentials instead of failing securely or enforcing local-only mode. This affects the core authentication path used by both CLI tools and helper utilities that depend on OpenClaw for credential sourcing.

RemediationAI

Upgrade OpenClaw to version 2026.3.11 or later, which fixes the credential fallback logic to properly validate local SecretRef availability without incorrectly treating unavailable references as unset. Administrators should also audit existing configurations to ensure that gateway.auth.token and gateway.auth.password SecretRefs point to valid, available resources; misconfigured or missing references should be corrected before upgrading to prevent triggering the fallback behavior. Review the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-credential-fallback-logic-bypass-via-unavailable-local-auth-secretrefs and the GitHub Security Advisory for detailed configuration guidance.