What’s Vulnerable › Vulnerabilities

CVE-2026-32029: OpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-19 · updated 2026-06-17
• Weakness: CWE-345

Description

OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoof client IP addresses. In proxy chains that append or preserve header values, attackers can inject malicious header content to influence security decisions including authentication rate-limiting and IP-based access controls.

Affected products

• OpenClaw: before 2026.2.21 — fixed in 2026.2.21

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.21. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/07039dc089e51589a213ec0d16f8d6f2cd871fa1
• https://github.com/openclaw/openclaw/commit/8877bfd11ec7760b115b2d0d7500a45da2749747
• https://github.com/openclaw/openclaw/security/advisories/GHSA-2rgf-hm63-5qph
• https://www.vulncheck.com/advisories/openclaw-client-ip-spoofing-via-x-forwarded-for-header-parsing

Get alerted when CVE-2026-32029 or the next vulnerability affects your stack