CVE-2026-32029: OpenClaw IP spoofing bypasses

CISO Take

OpenClaw prior to 2026.2.21 improperly trusts the leftmost X-Forwarded-For header from proxy chains, letting any network attacker inject a spoofed IP to defeat rate-limiting and IP-based authentication controls protecting the agent framework. Despite a medium CVSS score of 5.3, this CVE sits in the top 91st EPSS percentile — exploitation is statistically more probable than the vast majority of published vulnerabilities — and OpenClaw's package ecosystem was already implicated in a Feb. 2026 malicious-skills incident (AIID #1368), underscoring that this framework is actively targeted. The attack requires zero privileges, no user interaction, and no special expertise, making opportunistic abuse trivially accessible. Patch immediately to 2026.2.21; if patching is blocked, strip or normalize X-Forwarded-For headers at the WAF or ingress before they reach the application, and layer independent rate-limiting at the infrastructure level.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

The CVSS 5.3 medium rating reflects a narrow integrity impact, but operational risk is materially higher for AI agent deployments. A 91st-percentile EPSS score on a network-accessible, no-auth, low-complexity vector means exploitation is expected. In agentic architectures, rate-limiting is often the primary control preventing credential brute-force, quota exhaustion, and automated abuse of tool-calling pipelines. Bypass of that control can cascade into authentication compromise or runaway resource consumption. The 396 CVEs in the same package signal a persistently vulnerable codebase, and 4 downstream dependents extend the blast radius.

How does the attack unfold?

Reconnaissance

Attacker identifies OpenClaw deployed behind a trusted reverse proxy by probing HTTP response headers, error messages, or public infrastructure disclosures.

AML.T0006

Header Injection

Attacker crafts requests with a spoofed X-Forwarded-For header placing a whitelisted or internal IP as the leftmost value, exploiting the improper parsing logic in OpenClaw.

AML.T0049

Defense Evasion

OpenClaw accepts the spoofed IP as the client address, neutralizing per-IP rate limiting and IP-based allowlist/blocklist enforcement.

AML.T0107

Impact

With rate controls bypassed, attacker conducts credential brute-force against agent authentication endpoints or invokes AI agent tool calls at unlimited scale, achieving account compromise or cost harvesting.

AML.T0034

Reconnaissance

Attacker identifies OpenClaw deployed behind a trusted reverse proxy by probing HTTP response headers, error messages, or public infrastructure disclosures.

AML.T0006

Header Injection

Attacker crafts requests with a spoofed X-Forwarded-For header placing a whitelisted or internal IP as the leftmost value, exploiting the improper parsing logic in OpenClaw.

AML.T0049

Defense Evasion

OpenClaw accepts the spoofed IP as the client address, neutralizing per-IP rate limiting and IP-based allowlist/blocklist enforcement.

AML.T0107

Impact

With rate controls bypassed, attacker conducts credential brute-force against agent authentication endpoints or invokes AI agent tool calls at unlimited scale, achieving account compromise or cost harvesting.

AML.T0034

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A None

What should I do?

5 steps

Patch: Upgrade to OpenClaw >= 2026.2.21 — the patch commits (07039dc, 8877bfd) correct the X-Forwarded-For parsing logic.
Workaround: If patching is blocked, configure the ingress proxy (nginx, Caddy, ALB) to strip or overwrite the X-Forwarded-For header before it reaches OpenClaw, ensuring only the proxy-injected trusted IP is seen by the application.
Defense-in-depth: Implement rate-limiting independently at the WAF or load balancer layer, not solely within the application.
Detection: Alert on requests with multiple comma-separated IPs in X-Forwarded-For, especially where the leftmost IP is an RFC-1918 or other privileged address originating from untrusted external sources.
Audit: Review OpenClaw's trusted proxy configuration — minimize the set of trusted upstream IPs to reduce the exploitable surface.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Framework AML.T0034 - Cost Harvesting AML.T0049 - Exploit Public-Facing Application AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.5 - AI system security controls

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to respond to and recover from identified AI risks

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-32029?

OpenClaw prior to 2026.2.21 improperly trusts the leftmost X-Forwarded-For header from proxy chains, letting any network attacker inject a spoofed IP to defeat rate-limiting and IP-based authentication controls protecting the agent framework. Despite a medium CVSS score of 5.3, this CVE sits in the top 91st EPSS percentile — exploitation is statistically more probable than the vast majority of published vulnerabilities — and OpenClaw's package ecosystem was already implicated in a Feb. 2026 malicious-skills incident (AIID #1368), underscoring that this framework is actively targeted. The attack requires zero privileges, no user interaction, and no special expertise, making opportunistic abuse trivially accessible. Patch immediately to 2026.2.21; if patching is blocked, strip or normalize X-Forwarded-For headers at the WAF or ingress before they reach the application, and layer independent rate-limiting at the infrastructure level.

Is CVE-2026-32029 actively exploited?

No confirmed active exploitation of CVE-2026-32029 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32029?

1. Patch: Upgrade to OpenClaw >= 2026.2.21 — the patch commits (07039dc, 8877bfd) correct the X-Forwarded-For parsing logic. 2. Workaround: If patching is blocked, configure the ingress proxy (nginx, Caddy, ALB) to strip or overwrite the X-Forwarded-For header before it reaches OpenClaw, ensuring only the proxy-injected trusted IP is seen by the application. 3. Defense-in-depth: Implement rate-limiting independently at the WAF or load balancer layer, not solely within the application. 4. Detection: Alert on requests with multiple comma-separated IPs in X-Forwarded-For, especially where the leftmost IP is an RFC-1918 or other privileged address originating from untrusted external sources. 5. Audit: Review OpenClaw's trusted proxy configuration — minimize the set of trusted upstream IPs to reduce the exploitable surface.

What systems are affected by CVE-2026-32029?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI orchestration layers, multi-agent systems.

What is the CVSS score for CVE-2026-32029?

CVE-2026-32029 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI orchestration layersmulti-agent systems

MITRE ATLAS Techniques

AML.T0034 Cost Harvesting

AML.T0049 Exploit Public-Facing Application

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.5

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spoof client IP addresses. In proxy chains that append or preserve header values, attackers can inject malicious header content to influence security decisions including authentication rate-limiting and IP-based access controls.

Exploitation Scenario

An attacker profiling an organization's AI agent infrastructure identifies OpenClaw deployed behind a corporate reverse proxy (Kubernetes ingress or cloud load balancer). The attacker sends HTTP requests with a crafted header such as `X-Forwarded-For: 10.0.0.1, <attacker-real-ip>`. OpenClaw reads the leftmost value (10.0.0.1) as the client IP and applies security decisions — rate limiting, allowlist checks — against that spoofed internal address. With per-IP rate limits neutralized, the attacker launches a credential brute-force attack against agent authentication endpoints, or invokes computationally expensive tool calls at unlimited scale, either compromising accounts or driving significant infrastructure cost against the victim organization.

Weaknesses (CWE)

CWE-345 Insufficient Verification of Data Authenticity

CWE-345 — Insufficient Verification of Data Authenticity: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Source: MITRE CWE corpus.