CVE-2026-35644 PUBLISHED

OpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots

Assigner: VulnCheck
Reserved: 04.04.2026 Published: 09.04.2026 Updated: 10.04.2026

OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive authentication information from URL userinfo components.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor OpenClaw
Product OpenClaw
Versions Default: unaffected
  • affected from 0 to 2026.3.22 (excl.)
  • Version 2026.3.22 is unaffected

Credits

  • Peng Zhou (@zpbrent) reporter

References

Problem Types

  • CWE-312: Cleartext Storage of Sensitive Information CWE