OpenClaw uses unprotected TXT records in Bonjour/mDNS discovery to provide routing hints and TLS fingerprints. Based on the description, it is inferred that an attacker on a shared or untrusted LAN can publish a rogue _openclaw-gw._tcp service that steers the client to an attacker‑controlled endpoint or forces it to accept an attacker’s certificate. This could lead to exfiltration of gateway credentials such as auth.token or auth.password. iOS and macOS clients used the TXT‑provided host hints and ports to build the connection URL, while iOS and Android allowed the discovery‑provided TLS fingerprint to override a previously stored TLS pin.

The affected product is OpenClaw, developed by the official OpenClaw team, built on Node.js. All releases prior to version 2026.2.14 are vulnerable. The issue manifests in the iOS and Android apps, which were in alpha during the time of disclosure, but any client that relies on mDNS discovery over an untrusted LAN is also impacted. No other vendors or major version ranges are reported as affected.

The CVSS score of 7.1 indicates a high severity. The EPSS value of "< 1%" suggests that while exploitation is possible, the probability of a successful attack at any given time is low; the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need physical or Wi‑Fi access to a shared network to advertise a malicious service record, achievable through local mDNS spoofing. If the target uses an unreleased alpha client, the impact could expose sensitive gateway credentials; otherwise the risk is limited to developers or testers in controlled environments.