CVE-2026-32029
OpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing
- State
- Published
- Severity
- 6.3 Medium
- Published
- Mar 19, 2026
- Updated
- Jun 23, 2026
- Reserved
- Mar 10, 2026
Description
OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoof client IP addresses. In proxy chains that append or preserve header values, attackers can inject malicious header content to influence security decisions including authentication rate-limiting and IP-based access controls.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-345 Insufficient Verification of Data Authenticity
Affected Products
| Product | Versions |
|---|---|
OpenClawOpenClaw |
|
References
- GitHub Security Advisory (GHSA-2rgf-hm63-5qph)vendor-advisory
- Patch Commit #1patch
- Patch Commit #2patch
- VulnCheck Advisory: OpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.