Openclaw cli: OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode (CVE-2026-32970)
Description
A vulnerability in openclaw CLI versions up to 2026.3.10 causes local authentication SecretRefs that are configured but unavailable to fall back to remote credentials in local mode. This fallback occurs because the system treats unavailable local credentials as if they were unset, potentially leading to the use of incorrect credential sources. The issue is fixed in version 2026.3.11.
CVSS v3.1
Score 2.5low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In openclaw CLI versions <= 2026.3.10, the local gateway helper credential resolution logic incorrectly treats configured but unavailable local authentication SecretRefs (gateway.auth.token and gateway.auth.password) as unset. This causes the system in local mode to fall back to remote credentials (gateway.remote.*) instead of failing closed. The vulnerability does not confirm a server-side authentication bypass but may cause local CLI and helper paths to select incorrect credentials. The fix in version 2026.3.11 ensures that remote fallback is only allowed when the local auth input is truly unset, by tracking configuration status separately from resolution success.
Potential Impact
Local CLI and helper components may use remote credentials instead of local ones when local SecretRefs are configured but unavailable, potentially leading to unintended credential usage. There is no confirmed server-side authentication bypass. The impact is limited to local credential resolution behavior.
Mitigation Recommendations
Upgrade openclaw CLI to version 2026.3.11 or later, where the issue is fixed. The fix prevents fallback to remote credentials unless the local authentication input is truly unset.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-32970
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245b412601ec6a3166b47
Added to database: 10/04/2026, 12:25:24 UTC
Last enriched: 10/04/2026, 12:59:30 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.