CVE-2026-32029
OpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
5th
OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoof client IP addresses. In proxy chains that append or preserve header values, attackers can inject malicious header content to influence security decisions including authentication rate-limiting and IP-based access controls.
| CWE | CWE-345 |
| Vendor | openclaw |
| Product | openclaw |
| Published | Mar 19, 2026 |
| Last Updated | Mar 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for openclaw openclaw
Be the first to know when new medium vulnerabilities affecting openclaw openclaw are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
OpenClaw / OpenClaw
0 < 2026.2.21
References
github.com: https://github.com/openclaw/openclaw/security/advisories/GHSA-2rgf-hm63-5qph github.com: https://github.com/openclaw/openclaw/commit/07039dc089e51589a213ec0d16f8d6f2cd871fa1 github.com: https://github.com/openclaw/openclaw/commit/8877bfd11ec7760b115b2d0d7500a45da2749747 vulncheck.com: https://www.vulncheck.com/advisories/openclaw-client-ip-spoofing-via-x-forwarded-for-header-parsing
Credits
Anthony DiSanti (@AnthonyDiSanti) Vincent Koc (@vincentkoc)