Information disclosure in OpenClaw - #VU125127
Published: April 8, 2026
Vulnerability identifier: #VU125127
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: OpenClaw
Affected software:
OpenClaw
OpenClaw
Detailed vulnerability description
The vulnerability allows a remote attacker to disclose sensitive information and modify management settings.
The vulnerability exists due to exposure of sensitive information in the Dashboard authentication flow when opening the Control UI in the browser. A remote attacker can access browser-controlled surfaces or persistent browser storage to recover reusable Gateway admin credentials and reuse them to disclose sensitive information and modify management settings.
User interaction is required to open the Dashboard in the browser.
Remediation
Install security update from vendor's website.