CVE-2026-32970: OpenClaw credential fallback bypasses

CISO Take

OpenClaw before 2026.3.11 contains a fail-open credential logic flaw (CWE-636) where unresolvable local SecretRefs for gateway authentication silently fall back to remote credentials instead of failing closed, allowing a low-privileged local attacker to cause the CLI and helper paths to authenticate against unintended remote sources. Although the absolute CVSS score is low (2.5), the EPSS places this in the 99th percentile by exploitation likelihood, and OpenClaw's ecosystem has already demonstrated active credential-theft abuse — AIID incident #1368 documented malicious skills delivering the AMOS credential stealer through this same platform. No public exploit or Nuclei template exists, and the CVE is not in CISA KEV, so urgency is moderate rather than emergency. Organizations running OpenClaw in local mode should upgrade to 2026.3.11 immediately, audit all SecretRef configurations to confirm they resolve correctly, and rotate any remote gateway credentials that may have been exposed on affected deployments.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Low absolute risk by CVSS (2.5) driven by local-only attack vector, high complexity, and confidentiality-only impact with no integrity or availability consequences. In an AI agent context the residual risk is meaningfully higher: credential boundary violations in agentic pipelines can silently escalate an agent's access to remote services, and the fail-open pattern (CWE-636) is particularly insidious because operators may never observe the fallback unless they specifically audit authentication logs. With only four downstream dependents the blast radius is contained, and the absence of public exploits or KEV listing reduces immediate operational pressure. The 99th-percentile EPSS ranking suggests this class of logic-level auth bypass attracts disproportionate attacker interest relative to its severity score.

How does the attack unfold?

Local Access

Attacker obtains low-privileged local shell access to a host running OpenClaw in local mode, either through existing credentials or a prior compromise.

AML.T0112.000

SecretRef Discovery

Attacker identifies or deliberately causes an unavailable SecretRef for gateway.auth.token or gateway.auth.password by locating an existing misconfiguration or invalidating the referenced secret.

AML.T0084

Fallback Exploitation

OpenClaw CLI or helper path treats the unresolvable SecretRef as unset and silently falls back to remote credentials, bypassing the local authentication boundary without error.

AML.T0106

Credential Harvesting

Attacker captures or abuses the remote credential material to authenticate against gateway services, AI APIs, or downstream resources originally protected by the local auth isolation.

AML.T0083

Local Access

Attacker obtains low-privileged local shell access to a host running OpenClaw in local mode, either through existing credentials or a prior compromise.

AML.T0112.000

SecretRef Discovery

Attacker identifies or deliberately causes an unavailable SecretRef for gateway.auth.token or gateway.auth.password by locating an existing misconfiguration or invalidating the referenced secret.

AML.T0084

Fallback Exploitation

OpenClaw CLI or helper path treats the unresolvable SecretRef as unset and silently falls back to remote credentials, bypassing the local authentication boundary without error.

AML.T0106

Credential Harvesting

Attacker captures or abuses the remote credential material to authenticate against gateway services, AI APIs, or downstream resources originally protected by the local auth isolation.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

2.5 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 1% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC High

PR Low

UI None

S Unchanged

C Low

I None

A None

What should I do?

5 steps

Patch immediately: upgrade OpenClaw to version 2026.3.11 or later.
Audit SecretRef configurations: verify that every gateway.auth.token and gateway.auth.password SecretRef referenced in local-mode deployments resolves successfully before deploying — treat any unresolvable reference as a blocking error.
Detect fallback events: until patched, instrument OpenClaw logs to alert on unexpected remote-credential authentication paths in local mode deployments.
Least-privilege enforcement: restrict local system access to OpenClaw service accounts to minimize the population that can trigger or exploit the fallback path.
Credential rotation: if any system ran an affected version with unresolvable local SecretRefs, rotate all associated remote gateway credentials as a precaution.

How is it classified?

Auth Bypass Data Extraction Agent AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration AML.T0084 - Discover AI Agent Configuration AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

6.1.2 - AI risk assessment

NIST AI RMF

GOVERN 1.2 - Accountability and policies for AI risk

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32970?

OpenClaw before 2026.3.11 contains a fail-open credential logic flaw (CWE-636) where unresolvable local SecretRefs for gateway authentication silently fall back to remote credentials instead of failing closed, allowing a low-privileged local attacker to cause the CLI and helper paths to authenticate against unintended remote sources. Although the absolute CVSS score is low (2.5), the EPSS places this in the 99th percentile by exploitation likelihood, and OpenClaw's ecosystem has already demonstrated active credential-theft abuse — AIID incident #1368 documented malicious skills delivering the AMOS credential stealer through this same platform. No public exploit or Nuclei template exists, and the CVE is not in CISA KEV, so urgency is moderate rather than emergency. Organizations running OpenClaw in local mode should upgrade to 2026.3.11 immediately, audit all SecretRef configurations to confirm they resolve correctly, and rotate any remote gateway credentials that may have been exposed on affected deployments.

Is CVE-2026-32970 actively exploited?

No confirmed active exploitation of CVE-2026-32970 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32970?

1. Patch immediately: upgrade OpenClaw to version 2026.3.11 or later. 2. Audit SecretRef configurations: verify that every gateway.auth.token and gateway.auth.password SecretRef referenced in local-mode deployments resolves successfully before deploying — treat any unresolvable reference as a blocking error. 3. Detect fallback events: until patched, instrument OpenClaw logs to alert on unexpected remote-credential authentication paths in local mode deployments. 4. Least-privilege enforcement: restrict local system access to OpenClaw service accounts to minimize the population that can trigger or exploit the fallback path. 5. Credential rotation: if any system ran an affected version with unresolvable local SecretRefs, rotate all associated remote gateway credentials as a precaution.

What systems are affected by CVE-2026-32970?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI agent deployments, multi-tenant AI infrastructure.

What is the CVSS score for CVE-2026-32970?

CVE-2026-32970 has a CVSS v3.1 base score of 2.5 (LOW). The EPSS exploitation probability is 0.10%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI agent deploymentsmulti-tenant AI infrastructure

MITRE ATLAS Techniques

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 6.1.2

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to cause CLI and helper paths to select incorrect credential sources, potentially bypassing intended local authentication boundaries.

Exploitation Scenario

An attacker with low-privileged shell access on a host running OpenClaw in local mode identifies an existing misconfiguration where a SecretRef for gateway.auth.token points to a secret that no longer exists, or deliberately invalidates the referenced secret. When OpenClaw's CLI or a helper process next performs gateway authentication, the fallback logic treats the absent SecretRef as unset and switches silently to remote credentials. The attacker captures the remote credential material — via process inspection, log capture, or network interception of the outbound authentication request — and uses it to authenticate directly against the remote gateway service or downstream AI API, gaining access to resources that the local authentication boundary was specifically designed to prevent.

Weaknesses (CWE)

CWE-636 Not Failing Securely ('Failing Open')

CWE-636 — Not Failing Securely ('Failing Open'): When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.