Openclaw cli: OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions (CVE-2026-32029)

OpenClaw CLI used the left-most value of the X-Forwarded-For header for requests originating from configured trusted proxies. In proxy chains that append or preserve header values, an attacker can inject spoofed client IP addresses into the header, potentially affecting security decisions dependent on client IP. This can lead to client IP spoofing in security-sensitive paths like authentication rate limiting and local/private classification. The OpenClaw documentation advises that reverse proxies overwrite inbound forwarding headers to prevent this issue. The vulnerability affects openclaw versions up to 2026.2.19-2 and is fixed in the planned release 2026.2.21.

An attacker can spoof client IP addresses in security-sensitive contexts behind trusted proxies that append or preserve X-Forwarded-For headers. This may allow bypassing IP-based restrictions such as rate limiting or local network classification. The impact is reduced if the recommended proxy configuration (overwriting forwarding headers) is followed.

A patch is available and planned for release in version 2026.2.21. Users should upgrade to this version once released. Additionally, ensure that reverse proxies are configured to overwrite rather than append or preserve the X-Forwarded-For header as recommended by OpenClaw documentation to reduce risk.