Information disclosure in OpenClaw - #VU125127
Published: April 8, 2026
Vulnerability identifier: #VU125127
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and modify management settings.
The vulnerability exists due to exposure of sensitive information in the Dashboard authentication flow when opening the Control UI in the browser. A remote attacker can access browser-controlled surfaces or persistent browser storage to recover reusable Gateway admin credentials and reuse them to disclose sensitive information and modify management settings.
User interaction is required to open the Dashboard in the browser.
Affected software
OpenClaw
Remediation
Install security update from vendor's website.
OpenClaw - update to 2026.3.7