OpenClaw before version 2026.3.31 contains an information‑disclosure flaw in the Control Interface bootstrap JSON. The vulnerability exposes the application version and assistant agent identifiers to anyone who can load the Control UI page, enabling attackers to acquire fingerprinting details that identify system versions and agent configurations. This is a CWE‑497 data exposure flaw that can be used for targeted probing or to inform further attacks, but it does not provide direct access to data or code.

The affected product is OpenClaw, all releases older than 2026.3.31. The vulnerability is present in installations running Node.js as indicated by the CPE string. No other product or vendor is listed.

The CVSS score is 6.9, indicating moderate severity, while the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of widespread exploitation. The likely attack vector is remote over the network, requiring access to the Control UI endpoint. Without additional authentication, any user who can reach the UI can harvest the bootstrap JSON payload to deduce version and agent information. Given its moderate score and low exploitation likelihood, the risk is limited to organizational reconnaissance rather than immediate compromise.