{"action":"Upgrade openclaw to 2026.2.21 or later.","affected":[{"fixed":"2026.2.21","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-32029"],"ecosystem":"npm","epss":0.00201,"exploited":false,"fixed_versions":["2026.2.21"],"ghsa_id":"GHSA-2rgf-hm63-5qph","id":"tcs_01M5KEV0Q09HQKRWXWBYJTNCDK","modified_at":"2026-03-25T19:48:01.829439Z","published_at":"2026-03-03T22:17:12Z","references":["https://osv.dev/vulnerability/GHSA-2rgf-hm63-5qph","https://github.com/openclaw/openclaw/security/advisories/GHSA-2rgf-hm63-5qph","https://nvd.nist.gov/vuln/detail/CVE-2026-32029","https://github.com/openclaw/openclaw/commit/07039dc089e51589a213ec0d16f8d6f2cd871fa1","https://github.com/openclaw/openclaw/commit/8877bfd11ec7760b115b2d0d7500a45da2749747","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-client-ip-spoofing-via-x-forwarded-for-header-parsing"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-2rgf-hm63-5qph","url":"https://osv.dev/vulnerability/GHSA-2rgf-hm63-5qph"}],"summary":"OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions"}